Enabling IP Profiler Rules Parent topic

Rules are set to monitor the behavior of all IP addresses and block them according to the threshold setting. Rules can be set for the following:
  • Spam
  • Viruses
  • DHA attacks
  • Bounced mail
WARNING
WARNING
Before enabling IP Profiler Rules, add all of your email server IP addresses (that send outgoing messages to IMSVA) to the IP Filtering Approved List. To configure the IP Filtering Approved List, see Adding Hosts to the Approved List.

Specifying IP Filtering Spam Settings Parent topic

Procedure

  1. Go to IP FilteringRules.
    The Rules screen appears with 4 tabs, one for each type of threat.
  2. Click the Spam tab.
    The Spam screen appears.
  3. Select the Enable check box to enable blocking of spam.
  4. Specify a value for the following:
    • Duration to monitor: The number of hours that IMSVA monitors email traffic to see if the percentage of spam messages exceeds the threshold you set.
    • Rate (%): Specify the maximum number of allowable messages with spam threats.
    • Total messages: Specify the total number of spam messages out of which the threshold percentage is calculated.
    Consider the following example:
    Duration to monitor: 1 hour at a rate of 20 out of 100.
    During each one-hour period that spam blocking is active, IMSVA starts blocking IP addresses when more than 20% of the messages it receives contain spam and the total number of messages exceeds 100.
  5. Next to Triggering action, select one of the following:
    • Block temporarily: Block messages from the IP address and allow the upstream MTA to try again.
    • Block permanently: Never allow another message from the IP address and do not allow the upstream MTA to try again.
  6. Optional: If you select Block temporarily, specify the block duration.
  7. Click Save.

Specifying IP Filtering Virus Settings Parent topic

Procedure

  1. Go to IP FilteringRules.
    The Rules screen appears with 4 tabs, one for each type of threat.
  2. Click the Virus tab.
    The Virus screen appears.
  3. Select the Enable check box to enable blocking of viruses.
  4. Configure the following:
    • Duration to monitor: The number of hours that IMSVA monitors email traffic to see if the percentage of messages with viruses exceeds the threshold you set.
    • Rate (%): Type the maximum number of allowable messages with viruses (the numerator).
    • Total messages: Type the total number of infected messages out of which the threshold percentage is calculated (the denominator).
    Consider the following example.
    Duration to monitor: 1 hour at a rate of 20 out of 100
    During each one-hour period that virus blocking is active, IMSVA starts blocking IP addresses when more than 20% of the messages it receives contain viruses and the total number of messages exceeds 100.
  5. Next to Triggering action, select one of the following:
    • Block temporarily: Block messages from the IP address and allow the upstream MTA to try again.
    • Block permanently: Never allow another message from the IP address and do not allow the upstream MTA to try again.
  6. Optional: If you select Block temporarily, specify the block duration.
  7. Click Save.

Specifying IP Filtering Directory Harvest Attack (DHA) Settings Parent topic

Procedure

  1. Go to IP FilteringRules.
    The Rules screen appears with 4 tabs, one for each type of threat.
  2. Click the DHA Attack tab.
    The DHA Attack screen appears.
  3. Select the Enable check box to enable blocking of directory harvest attacks.
  4. Configure the following:
    • Duration to monitor: The number of hours that IMSVA monitors email traffic to see if the percentage of messages signaling a DHA attack exceeds the threshold you set.
    • Rate (%): Type the maximum number of allowable messages with DHA threats (the numerator).
    • Total messages: Type the total number of DHA messages out of which the threshold percentage is calculated (the denominator).
    • Sent to more than: Type the maximum number of recipients allowed for the threshold value.
    • Non-existing recipients exceeds: Type the maximum number of non-existent recipients allowed for the threshold value. DHA attacks often include randomly generated email addresses in the receiver list.
      Note
      Note
      The LDAP service must be running to determine non-existing recipients.
    Consider the following example.
    Duration to monitor: 1 hour at a rate of 20 out of 100 sent to more than 10 recipients when the number of non-existing recipients exceeds 5.
    During each one-hour period that DHA blocking is active, IMSVA starts blocking IP addresses when it receives more than 20% of the messages that were sent to more than 10 recipients (with more than five of the recipients not in your organization) and the total number of messages exceeds 100.
    Tip
    Tip
    Technically, the LDAP server is not a must-have. The DHA rule of IMSVA can also obtain the DHA results returned from Postfix, which in turn passes these results to FoxProxy through the LDAP server or other means. FoxProxy then analyzes the results to determine if they are DHA attacks.
    LDAP server is only one of the means by which Postfix checks if a user's mailbox exists.
  5. Next to Triggering action, select one of the following
    • Block temporarily: Block messages from the IP address and allow the upstream MTA to try again.
    • Block permanently: Never allow another message from the IP address and do not allow the upstream MTA to try again.
  6. Optional: If you select Block temporarily, specify the block duration.
  7. Click Save.

Specifying IP Filtering Bounced Mail Settings Parent topic

Procedure

  1. Go to IP Filtering Rules.
    The Rules screen appears with 4 tabs, one for each type of threat.
  2. Click the Bounced Mail tab.
    The Bounced Mail screen appears.
  3. Select the Enable check box to enable blocking of bounced mail.
  4. Configure the following:
    • Duration to monitor: The number of hours that IMSVA monitors email traffic to see if the percentage of messages signaling bounced mail exceeds the threshold you set.
    • Rate (%): Specify the maximum number of allowable messages signaling bounced mail (the numerator).
    • Total messages: Specify the total number of bounced messages out of which the threshold percentage is calculated (the denominator).
    Consider the following example:
    Duration to monitor: 1 hour at a rate of 20 out of 100
    During each one-hour period that blocking for bounced mail is active, IMSVA starts blocking IP addresses when more than 20% of the messages it receives are bounced messages and the total number of messages exceeds 100.
    Note
    Note
    The LDAP service must be running to check bounced mail.
  5. Next to Triggering action, select one of the following:
    • Block temporarily: Block messages from the IP address and allow the upstream MTA to try again.
    • Block permanently: Never allow another message from the IP address and do not allow the upstream MTA to try again.
  6. Optional: If you select Block temporarily, specify the block duration.
  7. Click Save.