If anyone needs this list, it is a denial list of many naughty state
actors ip addressesand has been useful
for us since it was installed.

Rather long but thorough.

Send an email address to us and we will send it as a zip or text file
whichever helps

David

On 23/03/2022 10:37, David Turner wrote:
> If anyone needs this list, it is a denial list of many naughty state actors ip addressesand has been useful
> for us since it was installed.
>
> Rather long but thorough.
>
> Send an email address to us and we will send it as a zip or text file whichever helps
>
>
> David
>

And for those using Linux, you can deny entire countries using Fail2ban

--
Mike R.
Home: http://alpha.mike-r.com/
QOTD: http://alpha.mike-r.com/qotd.php
No Micro$oft products were used in the URLs above, or in preparing this message.
Recommended reading: http://www.catb.org/~esr/faqs/smart-questions.html#before
and: http://alpha.mike-r.com/jargon/T/top-post.html
Missile address: N31.7624/E34.9691

In article <DNOdnS_GCcXZQaf_nZ2dnUU7-eudnZ2d@supernews.com>,
David Turner <dturner@islandco.com> wrote:
>If anyone needs this list, it is a denial list of many naughty state
>actors ip addressesand has been useful
>for us since it was installed.

Why not just use a DNS blocklist and let Spamhaus update it instead
of fighting to constantly keep it up to date?
--scott
--
"C'est un Nagra. C'est suisse, et tres, tres precis."

On 3/23/2022 2:49 PM, Scott Dorsey wrote:
> In article <DNOdnS_GCcXZQaf_nZ2dnUU7-eudnZ2d@supernews.com>,
> David Turner <dturner@islandco.com> wrote:
>> If anyone needs this list, it is a denial list of many naughty state
>> actors ip addressesand has been useful
>> for us since it was installed.
> Why not just use a DNS blocklist and let Spamhaus update it instead
> of fighting to constantly keep it up to date?
> --scott

Using that also - Spamhaus only blocks known actors, not all.

I figure we don't sell to Russia any more anyway. So where's the harm?

> I figure we don't sell to Russia any more anyway. So where's the harm?

The potential harm is that such lists are at best approximations:

They're prone to not having _all_ the IPs assigned to a given geographic
area, due to errors or horse trading of IP blocks. Thus they may give a
false sense of security.

They're prone to including things that are no longer assigned to a given
geographic area, for the same reasons. They may therefore block wanted
traffic.

They fail to account for VPNs. Because of this, they may block wanted
traffic from legitimate but anonymity-conscious users who happened to be
assigned an outbound point within a blacklisted block.

They fail to account for the trivial availability of virtual machine
availability as a launching point for whatever activity is (not) being
blocked by the use of the list.

None of this means blacklists are completely useless, but one should not
use them without a firm understanding of the tradeoffs.

De

We also use Spamhaus, (zen) and god knows how many other blacklists
The htaccess file we have been using, though perhaps over cautious, has
blocked potential harm
from several unruly countries. We had a credit card scam run on our
website a while back before we implemented this
It costs us $2500 from attempted credit-card bot authorizations. That
alone was a good reason to block any group of ips
We do have log files and they did show numerous hits from very specific
countries and cities

So...

On 3/25/2022 9:11 AM, Dennis Boone wrote:
> > I figure we don't sell to Russia any more anyway. So where's the harm?
>
> The potential harm is that such lists are at best approximations:
>
> They're prone to not having _all_ the IPs assigned to a given geographic
> area, due to errors or horse trading of IP blocks. Thus they may give a
> false sense of security.
>
> They're prone to including things that are no longer assigned to a given
> geographic area, for the same reasons. They may therefore block wanted
> traffic.
>
> They fail to account for VPNs. Because of this, they may block wanted
> traffic from legitimate but anonymity-conscious users who happened to be
> assigned an outbound point within a blacklisted block.
>
> They fail to account for the trivial availability of virtual machine
> availability as a launching point for whatever activity is (not) being
> blocked by the use of the list.
>
> None of this means blacklists are completely useless, but one should not
> use them without a firm understanding of the tradeoffs.
>
> De

David Turner <dturner@islandco.com> wrote:
>On 3/23/2022 2:49 PM, Scott Dorsey wrote:
>> In article <DNOdnS_GCcXZQaf_nZ2dnUU7-eudnZ2d@supernews.com>,
>> David Turner <dturner@islandco.com> wrote:
>>> If anyone needs this list, it is a denial list of many naughty state
>>> actors ip addressesand has been useful
>>> for us since it was installed.
>> Why not just use a DNS blocklist and let Spamhaus update it instead
>> of fighting to constantly keep it up to date?
>
>Using that also - Spamhaus only blocks known actors, not all.
>
>I figure we don't sell to Russia any more anyway. So where's the harm?

So your list isn't a list of naughty state actors at all, but random addresses
in specific countries?

If that's what you want, there are DNS-based lists for that too.
--scott

--
"C'est un Nagra. C'est suisse, et tres, tres precis."

It is a compilation of  naughty boys, hackers,  cities, countries and
regions

On 3/25/2022 1:09 PM, Scott Dorsey wrote:
> David Turner <dturner@islandco.com> wrote:
>> On 3/23/2022 2:49 PM, Scott Dorsey wrote:
>>> In article <DNOdnS_GCcXZQaf_nZ2dnUU7-eudnZ2d@supernews.com>,
>>> David Turner <dturner@islandco.com> wrote:
>>>> If anyone needs this list, it is a denial list of many naughty state
>>>> actors ip addressesand has been useful
>>>> for us since it was installed.
>>> Why not just use a DNS blocklist and let Spamhaus update it instead
>>> of fighting to constantly keep it up to date?
>> Using that also - Spamhaus only blocks known actors, not all.
>>
>> I figure we don't sell to Russia any more anyway. So where's the harm?
> So your list isn't a list of naughty state actors at all, but random addresses
> in specific countries?
>
> If that's what you want, there are DNS-based lists for that too.
> --scott
>