There is nothing irrational about identifying the source of unwanted traffic, qualifying what is or isn't malicious, and then taking whatever action you feel is appropriate. If there is no reason (business, personal, or otherwise) for traffic from the US or the UK to be reaching your network, then by all means block all of it if that is what you choose to do. If you re-read my post, you'll see that the purpose for the sets is for people to make *educated* decisions regarding what they may choose to block and from where. In my case (and cases where colleagues tested this) blocking all SMTP from China resulted in a dramatic (not just "noticeable") reduction in overall SPAM. In the case of the site that I own (HoG) I decided to actually block ALL traffic from China across the board. Does this mean that some people who legitimately want to view Hammer of God content will blocked? Yep. Sure does - but that is my choice to make. I don't get emails from people in China, so SMTP is no problem. My web traffic gets logged in SQL as well - and I have looked for valid requests there as well, and have not seen any - so I think it is a perfectly valid action *for me*. It obviously isn't for other people, but at least they can make their own decisions of what to block (or allow) from where. Nowhere did I say "you need to block all traffic from these countries." I simply said "here are pre-constructed IP sets by country for you to use to make educated and informed decisions of what to do for your network." There's nothing irrational about that. t > -----Original Message----- > From: Paa.listas [mailto:paa.listas@xxxxxxxxx] > Sent: Saturday, January 19, 2008 3:19 AM > To: Thor (Hammer of God); bugtraq@xxxxxxxxxxxxxxxxx > Subject: RE: Country by Country ISA Computer Sets > > Hello, > > Most of the attacks to my network come from USA and UK. Do I need > to > deny all access from those countries? I think that the simple idea is > irrational. > > I should block _attacks_ from those countries, inform the IP > owners(ISP), > and keep my network secure (it is the least that I can do) nothing more > against those (or any other) country. > > That is what I think. :) > > Saludos. Pablo.
