Domain: okean.com
Stories and comments across the archive that link to okean.com.
Comments · 34
-
Re:Block all of China?
What format would you like that in?
http://www.okean.com/antispam/china.html
There are a number of such lists for Nigeria, China, Eastern Europe, etc. See http://www.parkansky.com/china.htm. This idea's been around for a while, and it's been useful. Blocking them at public points like a Great Firewall would be detrimental to freedom, but most individuals and companies don't need packets coming from China or Nigeria or Romania, so the more people who know how to block this traffic from their own systems if they so desire, the better. Sure, a determined hacker will set up a VPN to hide his real point of origin, but very many attacks originate from Chinese IP addresses without an intervening proxy, so it's worthwhile making life (even just a tad) harder for the people who want to make life harder for you.
-
Re:block china
knew how to "block all of the Chinese IP ranges"
Okean.com has the goods.
-
And this is why....
lists like http://www.okean.com/chinacidr.txt are nice and hand to feed into your edge router.
-
NOT from .cn / .krMy organization expects NO legitimate mail from characters in these locations.
Therefore we use the following : http://www.okean.com/thegoods.html
in addition to other spam-filtering practices.
Props to the guy for maintaining this.
-
Re:I got this
-
Re:Blacklist 'em
I found this site that has Chinese and Korean lists in several formats
-
Re:Packet Filter
Yes, mine. ; )
-
Packet Filter
If you don't expect/want traffic from China, configure your firewall to block IP addresses assigned to China.
-
Re:Retaliation
That's it, I'm going to block China
I don't know if you're joking or not but if you're not here you go (and other formats)!
Here's a brief explanation on how to do it in Apache with Russian and Nigerian IP ranges also. You may be tempted to do what many other people are already doing but remember that language barrier aside, you're blocking your website from 1/6th of the Earth's population. -
Re:Retaliation
That's it, I'm going to block China
I don't know if you're joking or not but if you're not here you go (and other formats)!
Here's a brief explanation on how to do it in Apache with Russian and Nigerian IP ranges also. You may be tempted to do what many other people are already doing but remember that language barrier aside, you're blocking your website from 1/6th of the Earth's population. -
Re:ok, so how do I block China
-
Re:ok, so how do I block China
-
Re:ok, so how do I block China
-
Re:ok, so how do I block China
-
Re:ok, so how do I block China
-
Re:Major increase for me
Not sure which CN/KR blocks you found...but if you want a complete listing, go to my site at:
http://www.okean.com/antispam/sinokorea.html
--Mike -
Re:Out of Date and Worthless
http://www.okean.com/antispam/sinokorea.html
And that, IPtables block on China and Korea, that chops most of your spam out as well. -
blackholes.us
Anyone know what happened to blackholes.us? I haven't been able to access it for a while now.
I did find a similar blacklist for China/Korea okean.com, but they don't have a DNSBL, just a list. -
Re:My ban list is extensive but I'm a home user on
Actually, there are a few pages that wil gelp you find blocks from rogue countries. But first on to the ethical questions--
I'm the admin for a company with around 70 employees, we maintain our own website, and mail systems. We had been getting pounded with spam and a lot of ssh attempts.
Before taking any action, we found that China (predominately) and Korea were the source of most of our break-in attempts and spam sources. Given that we do _some_ international business, but not there, that was an easy call. Other countries soon followed. Our criteria has been that if there is any chance that someone will travel to a particular country or if the country has useful information to be had via someone with email, we don't block. I know it sounds judgmental, but it has cut our spam/scams down by about 75%. I would prefer to block all cable access to mail, but that would potentially hurt our road warriors with SMTP-AUTH. The slippery slope comes in when you say "Screw anyone on Wannadoo or BTI or Time Warner, etc. running a mail server." I know I quit running a mail server at home just because my stuff was blocked. Our compromise is that spam sources are individually blocked (rather than by range) in places where we travel or may do business.
Further if you have a good firewall scheme you don't have to block web access. You can block the ports that give you trouble and still allow http access if you need the Chinese comsumer market to see your site. I have found that an invaluable tool to use in conjuntion with iptables is IPSet.
It allows for very quick processing of ranges or hashes of individual addresses.
If you want info on blocking countries (sorry if I offend anyone) look here:
http://okean.com/asianspamblocks.html
and http://blackholes.us/ (when it's up...)
Personally, I find blocking unwanted guests akin to allowing only people on your chat list to talk to you... -
Depends on service
But yes, I long since blocked access to most services for most of Asia, and large parts of Brazil and Mexico. Started with this very useful list of Chinese and Korean ip-blocks: http://www.okean.com/thegoods.html and grew from there (mostly to include Taiwan). (Note: I've found the list to be 99% accurate, but some small
/24 or smaller blocks in Australia got included erroneously. Use with caution) -
Be Advised
I just lit back up a site that had been registered, but off-line for about 2 years. I decided to just watch and baseline things before doing anything with the site. The site had zero content and no robots file.
Beyond the ususal search engines trying to index the site (actually only a handfull of indexers), the *ONLY* other traffic the site received was shitloads of probes and out-right attemptes to exploit primarily from Chinese address space.
Most of the attempts has been pretty script-kiddish; it would appear that they're looking for large numbers (a bot army).
So....
Since I really don't give a flying crap about my Chinese audience (or being a part of their bot army):
http://www.okean.com/sinokoreacidr.txt
Korea got thrown in to boot because:
1) Korea (north and south) is nothing more than Mid-Southern China
2) high percentage of always on DSL
3) some of the more technical attacks were comming out of Korea
So...
Not enough can be said about having pf in front of apache, not to mention a having a transparent reverse proxy. -
Re:Easy Solution!
I have an easy solution, provided by a friend of mine at a major local university -- Block ALL mail from China.
Here is my China-Korea spam-blocking script: #!/bin/sh #firewall for china and korea, port 25. #http://www.okean.com/iptables/rc.firewall.sinokor ea #send comments, corrections, and additions to: submit@okean.com #last updated 2005.06.05 1054 PDT (UTC -7) iptables -A INPUT -i eth0 -p tcp -s 58.14.0.0/15 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 58.16.0.0/14 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 58.20.0.0/16 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 58.22.0.0/15 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 58.24.0.0/15 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 58.30.0.0/15 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 58.32.0.0/13 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 58.40.0.0/15 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 58.42.0.0/16 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 58.44.0.0/14 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 58.48.0.0/13 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 58.65.64.0/18 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 58.66.0.0/15 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 58.72.0.0/13 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 58.82.0.0/15 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 58.87.64.0/18 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 58.102.0.0/15 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 58.116.0.0/14 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 58.120.0.0/13 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 58.128.0.0/13 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 58.140.0.0/14 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 58.144.0.0/16 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 58.145.0.0/17 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 58.148.0.0/14 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 58.192.0.0/14 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 58.200.0.0/13 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 58.240.0.0/14 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 59.0.0.0/11 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 59.32.0.0/12 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 59.48.0.0/14 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 59.52.0.0/14 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 59.56.0.0/13 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 59.64.0.0/13 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 59.72.0.0/15 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 59.77.0.0/16 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 59.78.0.0/15 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 59.80.0.0/14 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 59.107.0.0/17 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 59.108.0.0/15 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 59.150.0.0/16 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 59.151.0.0/17 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 59.186.0.0/15 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 59.191.0.0/17 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 59.192.0.0/10 --destination-port 25 -j DROP iptables -A INPUT -i eth0 -p tcp -s 60.0.0.0/13 --destination-port 25 -j DROP iptables -
-
Blame Canad^H^H^H^H^HKorea!At least you don't have some punk trying to find a weak username/password combo through SSH. (Silly script kiddie, you can't login to root through SSH on my box.)
One way of dealing with that problem is to block China and Korea altogether. All the l33+ h4x0r5 who try to password guess on my ssh daemons come from educational institutions in Korea. Block them at the border router, problem goes away!
-
Re:Private blocklists.
I firewall port 25 from
.cn and .kr. They are all spammers and infected with shit.
cn-kr iptables blocklist here.
My DNSBLs:
FEATURE(dnsbl, `bl.spamcop.net', `DNS-block-check-01. Shut your fucking face uncle spammer. You are a relay raping chicken-boning server-fucker.')dnl
FEATURE(dnsbl, `relays.ordb.org', `DNS-block-check-02. Shut your fucking face uncle spammer. You are a relay raping chicken-boning server-fucker.')dnl
FEATURE(dnsbl, `blackholes.easynet.nl', `DNS-block-check-03. Shut your fucking face uncle spammer. You are a relay raping chicken-boning server-fucker.')dnl
FEATURE(dnsbl, `cw.blackholes.us', `DNS-block-check-04. Shut your fucking face uncle spammer. You are a relay raping chicken-boning server-fucker.')dnl
FEATURE(dnsbl, `burst.blackholes.us', `DNS-block-check-05. Shut your fucking face uncle spammer. You are a relay raping chicken-boning server-fucker.')dnl
FEATURE(dnsbl, `bellsouth.blackholes.us', `DNS-block-check-06. Shut your fucking face uncle spammer. You are a relay raping chicken-boning server-fucker.')dnl
FEATURE(dnsbl, `rackspace.blackholes.us', `DNS-block-check-07. Shut your fucking face uncle spammer. You are a relay raping chicken-boning server-fucker.')dnl
FEATURE(dnsbl, `level3.blackholes.us', `DNS-block-check-08. Shut your fucking face uncle spammer. You are a relay raping chicken-boning server-fucker.')dnl
FEATURE(dnsbl, `he.blackholes.us', `DNS-block-check-09. Shut your fucking face uncle spammer. You are a relay raping chicken-boning server-fucker.')dnl
FEATURE(dnsbl, `verio.blackholes.us', `DNS-block-check-10. Shut your fucking face uncle spammer. You are a relay raping chicken-boning server-fucker.')dnl
FEATURE(dnsbl, `nigeria.blackholes.us', `DNS-block-check-11. Shut your fucking face uncle spammer. You are a relay raping chicken-boning server-fucker.')dnl
FEATURE(dnsbl, `sbl.spamhaus.org', `DNS-block-check-12. Shut your fucking face uncle spammer. You are a relay raping chicken-boning server-fucker.')dnl
FEATURE(dnsbl, `list.dsbl.org', `DNS-block-check-13. Shut your fucking face uncle spammer. You are a relay raping chicken-boning server-fucker.')dnl
FEATURE(dnsbl, `dnsbl.njabl.org', `DNS-block-check-15. Shut your fucking face uncle spammer. You are a relay raping chicken-boning server-fucker.')dnl
FEATURE(dnsbl, `dnsbl.sorbs.net', `DNS-block-check-16. Shut your fucking face uncle spammer. You are a relay raping chicken-boning server-fucker.')dnl
FEATURE(dnsbl, `psbl.surriel.com', `DNS-block-check-17. Shut your fucking face uncle spammer. You are a relay raping chicken-boning server-fucker.')dnl
FEATURE(dnsbl, `dnsbl.net.au', `DNS-block-check-18. Shut your fucking face uncle spammer. You are a relay raping chicken-boning server-fucker.')dnl
FEATURE(dnsbl, `opm.blitzed.org', `DNS-block-check-19. Shut your fucking face uncle spammer. You are a relay raping chicken-boning server-fucker.')dnl
FEATURE(dnsbl, `cbl.abuseat.org', `DNS-block-check-20. Shut your fucking face uncle spammer. You are a relay raping chicken-boning server-fucker.')dnl
FEATURE(dnsbl, `blackholes.intersil.net', `DNS-block-check-21. Shut your fucking face uncle spammer. You are a relay raping chicken-boning server-fucker.')dnl
FEATURE(dnsbl, `spews.org', `DNS-block-check-22. Shut your fucking face uncle spammer. You are a relay raping chicken-boning server-fucker.')dnl
FEATURE(dnsbl, `dnsbl.ahbl.org', `DNS-block-check-23. Shut your fucking face uncle spammer. You are a relay raping chicken-boning server-fucker.')dnl
I get very little spam that gets through. Oh, and I dont care if I block legitimate mail. If they wanna write to me they can use hotmail or something if its really that important. -
IPTables really helps.
Just blocking China and Korean IP space from connecting to port 25 does wonders for reducing spam. See: http://www.okean.com/iptables/rc.firewall.sinokor
e a -
Oh, and for iptables
Easy to cut and paste format. It's not directly linked from the other blocklists, but it's in the sitemap.
-
Here you go
http://www.okean.com/asianspamblocks.html - Detailed blocks so you get fewer innocents.
-
Procmail
I recently moved my web site to a hosting company that allows me to use, along with a lot of other cool stuff, procmail filters. In one morning I learned enough about writing procmail rules to cut my daily spam amount from 1000 to 300 without risking false positives. (I have so far resisted using spamassassin, etc, preferring to use Mailwasher so I can quickly review what will be deleted.)
Following the links posted in this thread, I've been looking at the list of Chinese and Korean IP blocks at this site...
http://www.okean.com/asianspamblocks.html
What would be the best way for me to block any e-mails originating from within these blocks?
Can it be done (reliably) with procmail or is it possible for spammers to fake the originating IP address? Come to think of it, I don't even know if e-mail headers include an originating address.
Is it something that must be done at the time of connection from an SMTP server? Does procmail work its magic too far down the line?
Thanks for any help! Going from 1000 down to 300 spams per day was an experience like no other, so I would dearly love to reduce that number even further! -
Re:Block .cn!
You have to know what IP addresses are physically located in China and block those.
Here you go:
http://www.okean.com/asianspamblocks.html
-
Re:blacklist the netblocks?
-
Use blacklists...
If you don't know anyone in China (or Asia) you can use a blacklist for the whole region. My firewall with OpenBSD's awesome spamd autoupdates its tarpit blacklists every couple of hours. One good list for Asian IPs is here.
I love the idea of tarpitting, seeing spammers connections being tied up for ~3300 seconds (my highest) warms my heart. If more people did it that'd mean less overall spam traffic. -
Re:Forget their secure email, I'm still out to ...Already been done:
#n apnic and arin blocks CIDR format
#http://www.okean.com/cidr.txt
#send comments, corrections, and additions to: contrib@okean.com
#last updated 11.28.03 2240 PST (GMT -8)
61.32.0.0/13, 61.40.0.0/14, 61.72.0.0/13, 61.80.0.0/13, 61.96.0.0/12, 61.248.0.0/13, 128.134.0.0/16, 129.254.0.0/16, 134.75.0.0/16, 137.68.0.0/16, 141.223.0.0/16, 143.248.0.0/16, 147.6.0.0/16, 147.43.0.0/16, 147.46.0.0/15, 150.150.0.0/16,
150.183.0.0/16, 150.197.0.0/16, 152.99.0.0/16, 152.149.0.0/16, 154.10.0.0/16, 155.230.0.0/16, 156.147.0.0/16, 57.197.0.0/16, 158.44.0.0/16, 161.122.0.0/16, 163.152.0.0/16, 163.180.0.0/16, 163.239.0.0/16, 164.124.0.0/15, 165.132.0.0/15, 165.141.0.0/16, 165.186.0.0/16, 165.194.0.0/16, 165.213.0.0/16, 165.229.0.0/16, 165.243.0.0/16,
165.244.0.0/16, 165.246.0.0/16, 166.79.0.0/16, 166.103.0.0/16, 166.104.0.0/16, 166.125.0.0/16, 168.78.0.0/16,
168.115.0.0/16, 168.126.0.0/16, 168.131.0.0/16, 168.154.0.0/16, 168.188.0.0/16, 168.219.0.0/16, 168.248.0.0/15,
169.140.0.0/16, 192.5.90.0/24, 192.100.2.0/24, 192.104.15.0/24, 192.132.15.0/24, 192.132.247.0/24, 192.132.248.0/22,
192.195.39.0/24, 192.195.40.0/24, 192.203.138.0/23, 192.203.140.0/22, 192.203.144.0/23, 192.203.146.0/24, 192.245.249.0/24, 192.245.250.0/23, 192.249.16.0/20, 198.178.187.0/24, 202.6.95.0/24, 202.14.103.0/24, 202.14.165.0/24,
202.20.82.0/23, 202.20.84.0/23, 202.20.86.0/24, 202.20.99.0/24, 202.20.119.0/24, 202.20.128.0/17, 202.21.0.0/21,
202.30.0.0/15, 202.189.128.0/18, 203.224.0.0/11, 210.80.96.0/19, 210.90.0.0/15, 210.92.0.0/14, 210.96.0.0/11, 210.178.0.0/15, 210.180.0.0/14, 210.204.0.0/14, 210.216.0.0/13, 211.32.0.0/11, 211.104.0.0/13, 211.112.0.0/13,
211.168.0.0/13, 211.176.0.0/12, 211.192.0.0/10, 218.36.0.0/14, 218.48.0.0/13, 218.144.0.0/12, 218.232.0.0/13, 219.240.0.0/15, 219.248.0.0/13, 220.64.0.0/13, 220.72.0.0/13, 220.80.0.0/13, 220.88.0.0/14, 220.92.0.0/14, 220.116.0.0/14 220.120.0.0/13, 221.138.0.0/15, 221.140.0.0/14, 221.144.0.0/12, 221.160.0.0/13, 221.168.0.0/16, 221.168.0.0/16, 222.96.0.0/12, 222.112.0.0/13, 222.120.0.0/15, 222.122.0.0/16
-
Re:No problem
This site lists Korean and Chinese netblocks.
-
Re:chinese proxy?
Oh, and by the way, if there are others who want to see for themselves , here is the list of all chinese IP ranges and a list of proxies to cross-reference with the former. Have fun
:-)