Is it safe to assume that most, if not all, emails from a *.ru domain may be considered spam? From a log of 30000 emails from *.ru, its all been spam (over two months).
Tell me more
×
IT Security Stack Exchange is a question and answer site for
IT security professionals. It's 100% free, no registration required.
|
|
No you cannot safely assume this. Maybe according to your mail servers you can assume this but overall only 4.9% of total spam comes from Russia according too Trustwave. According to Securelist the numer is as low as 1.7% for January 2012. See this picture for how far down Russia places on the spam list:
Edit: additional info. If you sometime have to do business with a Russian you would have a bug that may be hard to identify later on, perhaps in a couple of years when you forgot about this configuration. Russia is the 9th largest country population wise in the entire world so it may be quite a big deal to block it. I would look at the spam designated to you and see if you can identify any common denominators in the headers or content of the spam. It may very well be other ways to distinguish between the spam and no spam than blocking everything. |
|||||||||||||||||||
|
|
Server-side filters for mail are a much better solution. Start with a couple of really good DNSRBLs and then add SPF checking. Also, make sure your host isn't an open relay using the various tools around the Internet. Finally, set up a system (e.g. 'fail2ban') that will automatically block IP addresses at the 'iptables' level for a deterministic amount of time when they attempt to log into hosted services and fail repeatedly. This approach lets automated software handle blocking of bad mail at the originating source that you never really wanted to get in the first place - and will block the *.ru spam in the process while letting legitimate mail through. After doing these things on my server, I saw a 99% drop in my incoming spam for my e-mail client. The rest of the inbound spam is dealt with by setting up a few simple client filters. You can, again, choose to block *.ru at this level but that is up to you. If you don't care about Russia or know anyone there, then block away but spammers always find new ways around generic blocks like that, so you'll be fighting a losing battle. |
|||
|
|
|
It might be that 99.99% of your mails from a .ru domain. However wether you can block it depends on the 0.001% that are not spam. What do you want to do with them and most importantly what does it cost you to lose that message. If this is a local site for a are in another country far away from Russia then it might be a small inconvience to you and you lose contact with someone. However if you are a site covering a more widespread are and say need to do business in Russia losing these emails might have a measurable cost in reputation if not money. In this case I think you have to ask the business owner how much it would cost to lose that contact and also tell them how much it would save to filter out the .ru domain an let them make a business decision. |
|||
|
|
|
I would assess based on where and how you conduct your business communication. If you NEVER conduct business outside of the united States then I would block all other traffic. I have doen this for several small and medium sized companies and I've yet to be called back on having to make an exception for an international address. |
|||
|
|
