Fli
08-20-2017, 10:14 AM
An e-mail with subject "RBL Check on *: [0] failures" can be sent from a Linux server which runs CSF (ConfigServer Firewall).
The e-mail can contain example this:
Checked * (PUBLIC) on Sun Aug 20 00:00:03 2017
query.senderbase.org
TIMEOUT
OK
Checked * (PUBLIC) on Sun Aug 20 00:00:17 2017
OK
The e-mail source code shows this in my case:
X-Source: /usr/local/cpanel/3rdparty/perl/524/bin/perl
X-Source-Args: /usr/local/cpanel/3rdparty/bin/perl /usr/sbin/csf --rbl [email protected]
So it is CSF that sends the e-mails. Here is the file that can be modified: /etc/csf/csf.rblconf
So there i can maybe disable query.senderbase.org as it TIMEOUTs.
in that file i can also add new RBLs by adding lines like:
disablerbl:bl.spamcannibal.org
enablerbl:black.junkemailfilter.com
enablerbl:blacklist.sci.kun.nl
enablerbl:bl.blocklist.de
enablerbl:bl.mailspike.net
enablerbl:block.dnsbl.sorbs.net
enablerbl:blocked.hilli.dk
enablerbl:bl.spamcop.net
enablerbl:bl.spameatingmonkey.net
enablerbl:bsb.empty.us
enablerbl:bogons.cymru.com
enablerbl:cart00ney.surriel.com
enablerbl:cbl.abuseat.org
enablerbl:cbl.anti-spam.org.cn
enablerbl:cdl.anti-spam.org.cn
enablerbl:cblless.anti-spam.org.cn
enablerbl:csi.cloudmark.com
enablerbl:db.wpbl.info
enablerbl:dev.null.dk
enablerbl:dialup.blacklist.jippg.org
enablerbl:dialups.mail-abuse.org
enablerbl:dialups.visi.com
enablerbl:dsn.rfc-ignorant.org
enablerbl:dnsbl.abuse.ch
enablerbl:dnsbl.anticaptcha.net
enablerbl:dnsbl.antispam.or.id
enablerbl:dnsbl.dronebl.org
enablerbl:dnsbl.inps.de
enablerbl:dnsbl.justspam.org
enablerbl:dnsbl.kempt.net
enablerbl:dnsbl.sorbs.net
enablerbl:dnsbl.tornevall.org
enablerbl:dnsbl-1.uceprotect.net
enablerbl:dnsbl-2.uceprotect.net
enablerbl:dnsbl-3.uceprotect.net
enablerbl:drone.abuse.ch
enablerbl:duinv.aupads.org
enablerbl:dul.dnsbl.sorbs.net
enablerbl:dul.ru
enablerbl:dyna.spamrats.com
enablerbl:escalations.dnsbl.sorbs.net
enablerbl:hil.habeas.com
enablerbl:http.dnsbl.sorbs.net
enablerbl:httpbl.abuse.ch
enablerbl:intruders.docs.uu.se
enablerbl:ips.backscatterer.org
enablerbl:ix.dnsbl.manitu.net
enablerbl:korea.services.net
enablerbl:mail-abuse.blacklist.jippg.org
enablerbl:misc.dnsbl.sorbs.net
enablerbl:msgid.bl.gweep.ca
enablerbl:multi.surbl.org
enablerbl:new.dnsbl.sorbs.net
enablerbl:no-more-funn.moensted.dk
enablerbl:noptr.spamrats.com
enablerbl:old.dnsbl.sorbs.net
enablerbl:opm.tornevall.org
enablerbl:pbl.spamhaus.org
enablerbl:proxy.bl.gweep.ca
enablerbl:psbl.surriel.com
enablerbl:pss.spambusters.org.ar
enablerbl:query.senderbase.org
enablerbl:rbl.interserver.net
enablerbl:rbl.megarbl.net
enablerbl:rbl.schulte.org
enablerbl:rbl.snark.net
enablerbl:rbl.spamlab.com
enablerbl:rbl.suresupport.com
enablerbl:recent.dnsbl.sorbs.net
enablerbl:recent.spam.dnsbl.sorbs.net
enablerbl:relays.bl.gweep.ca
enablerbl:relays.nether.net
enablerbl:rsbl.aupads.org
enablerbl:sbl.nszones.com
enablerbl:sbl.spamhaus.org
enablerbl:sbl-xbl.spamhaus.org
enablerbl:short.rbl.jp
enablerbl:smtp.dnsbl.sorbs.net
enablerbl:socks.dnsbl.sorbs.net
enablerbl:spam.abuse.ch
enablerbl:spam.dnsbl.anonmails.de
enablerbl:spam.dnsbl.sorbs.net
enablerbl:spamguard.leadmon.net
enablerbl:spam.olsentech.net
enablerbl:spamrbl.imp.ch
enablerbl:spamsources.fabel.dk
enablerbl:spam.spamrats.com
enablerbl:st.technovision.dk
enablerbl:tor.dan.me.uk
enablerbl:tor.dnsbl.sectoor.de
enablerbl:truncate.gbudb.net
enablerbl:ubl.unsubscore.com
enablerbl:virbl.bit.nl
enablerbl:virus.rbl.jp
enablerbl:web.dnsbl.sorbs.net
enablerbl:wormrbl.imp.ch
enablerbl:xbl.spamhaus.org
enablerbl:zen.spamhaus.org
enablerbl:zombie.dnsbl.sorbs.net
To disable all RBL reporting e-mails, i go to WHM, Plugins, ConfigServer Security & Firewall, Check for IPs in RBLs (button), and set "Generate and email this report "Never" to the email address [email protected]
The e-mail can contain example this:
Checked * (PUBLIC) on Sun Aug 20 00:00:03 2017
query.senderbase.org
TIMEOUT
OK
Checked * (PUBLIC) on Sun Aug 20 00:00:17 2017
OK
The e-mail source code shows this in my case:
X-Source: /usr/local/cpanel/3rdparty/perl/524/bin/perl
X-Source-Args: /usr/local/cpanel/3rdparty/bin/perl /usr/sbin/csf --rbl [email protected]
So it is CSF that sends the e-mails. Here is the file that can be modified: /etc/csf/csf.rblconf
So there i can maybe disable query.senderbase.org as it TIMEOUTs.
in that file i can also add new RBLs by adding lines like:
disablerbl:bl.spamcannibal.org
enablerbl:black.junkemailfilter.com
enablerbl:blacklist.sci.kun.nl
enablerbl:bl.blocklist.de
enablerbl:bl.mailspike.net
enablerbl:block.dnsbl.sorbs.net
enablerbl:blocked.hilli.dk
enablerbl:bl.spamcop.net
enablerbl:bl.spameatingmonkey.net
enablerbl:bsb.empty.us
enablerbl:bogons.cymru.com
enablerbl:cart00ney.surriel.com
enablerbl:cbl.abuseat.org
enablerbl:cbl.anti-spam.org.cn
enablerbl:cdl.anti-spam.org.cn
enablerbl:cblless.anti-spam.org.cn
enablerbl:csi.cloudmark.com
enablerbl:db.wpbl.info
enablerbl:dev.null.dk
enablerbl:dialup.blacklist.jippg.org
enablerbl:dialups.mail-abuse.org
enablerbl:dialups.visi.com
enablerbl:dsn.rfc-ignorant.org
enablerbl:dnsbl.abuse.ch
enablerbl:dnsbl.anticaptcha.net
enablerbl:dnsbl.antispam.or.id
enablerbl:dnsbl.dronebl.org
enablerbl:dnsbl.inps.de
enablerbl:dnsbl.justspam.org
enablerbl:dnsbl.kempt.net
enablerbl:dnsbl.sorbs.net
enablerbl:dnsbl.tornevall.org
enablerbl:dnsbl-1.uceprotect.net
enablerbl:dnsbl-2.uceprotect.net
enablerbl:dnsbl-3.uceprotect.net
enablerbl:drone.abuse.ch
enablerbl:duinv.aupads.org
enablerbl:dul.dnsbl.sorbs.net
enablerbl:dul.ru
enablerbl:dyna.spamrats.com
enablerbl:escalations.dnsbl.sorbs.net
enablerbl:hil.habeas.com
enablerbl:http.dnsbl.sorbs.net
enablerbl:httpbl.abuse.ch
enablerbl:intruders.docs.uu.se
enablerbl:ips.backscatterer.org
enablerbl:ix.dnsbl.manitu.net
enablerbl:korea.services.net
enablerbl:mail-abuse.blacklist.jippg.org
enablerbl:misc.dnsbl.sorbs.net
enablerbl:msgid.bl.gweep.ca
enablerbl:multi.surbl.org
enablerbl:new.dnsbl.sorbs.net
enablerbl:no-more-funn.moensted.dk
enablerbl:noptr.spamrats.com
enablerbl:old.dnsbl.sorbs.net
enablerbl:opm.tornevall.org
enablerbl:pbl.spamhaus.org
enablerbl:proxy.bl.gweep.ca
enablerbl:psbl.surriel.com
enablerbl:pss.spambusters.org.ar
enablerbl:query.senderbase.org
enablerbl:rbl.interserver.net
enablerbl:rbl.megarbl.net
enablerbl:rbl.schulte.org
enablerbl:rbl.snark.net
enablerbl:rbl.spamlab.com
enablerbl:rbl.suresupport.com
enablerbl:recent.dnsbl.sorbs.net
enablerbl:recent.spam.dnsbl.sorbs.net
enablerbl:relays.bl.gweep.ca
enablerbl:relays.nether.net
enablerbl:rsbl.aupads.org
enablerbl:sbl.nszones.com
enablerbl:sbl.spamhaus.org
enablerbl:sbl-xbl.spamhaus.org
enablerbl:short.rbl.jp
enablerbl:smtp.dnsbl.sorbs.net
enablerbl:socks.dnsbl.sorbs.net
enablerbl:spam.abuse.ch
enablerbl:spam.dnsbl.anonmails.de
enablerbl:spam.dnsbl.sorbs.net
enablerbl:spamguard.leadmon.net
enablerbl:spam.olsentech.net
enablerbl:spamrbl.imp.ch
enablerbl:spamsources.fabel.dk
enablerbl:spam.spamrats.com
enablerbl:st.technovision.dk
enablerbl:tor.dan.me.uk
enablerbl:tor.dnsbl.sectoor.de
enablerbl:truncate.gbudb.net
enablerbl:ubl.unsubscore.com
enablerbl:virbl.bit.nl
enablerbl:virus.rbl.jp
enablerbl:web.dnsbl.sorbs.net
enablerbl:wormrbl.imp.ch
enablerbl:xbl.spamhaus.org
enablerbl:zen.spamhaus.org
enablerbl:zombie.dnsbl.sorbs.net
To disable all RBL reporting e-mails, i go to WHM, Plugins, ConfigServer Security & Firewall, Check for IPs in RBLs (button), and set "Generate and email this report "Never" to the email address [email protected]