cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
3177
Views
0
Helpful
8
Replies

Query Senderbase

Is it possible to query Senderbase on a C650 to get the SBRS for a given IP? At www.senderbase.org I don't get the reputation score...

Thanks,
Axel

8 Replies 8

No - the only way to get a repuation score is to run queries from your appliance. You can do this using the GUI or the CLI using the trace command to learn the reputation score quickly.

We hide the repuation score of senders to prevent spammers learning how we score senders.

Bloke,

I'm not sure you are correct, I do this all the time. I go down to Incoming Mail and specify IP Address from the drop down (I'm on 5.x code) and then plug in the IP Address and hit submit and you should see the SBRS score in the bottom section of the Web page.

Sincerely,

Jay Bivens
IronPort Systems

Ok, but I don't want to allow everybody in my company to login...
Is there any Webservice on the appliance for Senderbase queries?

No, no web service. You could script logging into the admin gui and doing the search, this is probably more work than its worth.

An easier option that may be appropriate in your situation is to add a content filter (for some users only?) that adds a header: X-SBRS: $Reputation. That will insert the SBRS score into a message header that semi-advanced users could then view by looking at all headers in the message.

This has the added advantage of showing you the SBRS score at the time the message was received. If users check the SBRS later it may have changed between the time it was received and the time it is checked.

Doc_ironport
Level 1
Level 1

Do you need to know the exact reputation score or just a range?

If you just need a general idea, http://www.senderbase.org/home/rep_lookup will give you a "Good", "Neutral" or "Bad" score for an IP address if that's enough.

Message modified by Ironport customer support -


For proprietary and security reasons, we ask that Ironport Nation forum members refrain from posting confidential information that may be useful for spammers to compromise Ironport appliances.

As mentioned previously, you can use the "trace" feature on the Ironport appliance to obtain the SBRS scores. Also, you can contact Ironport customer support and we can provide more information on the senderbase score of an IP address.

Thank you for your participation and help in making the Ironport Nation an added resource to your Ironport appliance.

- Ironport customer support

Thanks! That's what I'm looking for :-)

I already knew that I can do a DNS Query. But I didn't know which subdomain I have to use.

jsinix.1337
Level 1
Level 1

You can use this https://github.com/jsinix/codemine/tree/master/Senderbase 

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: