In this article I'm going to quickly go over how you can block certain IP addresses from being able to send you email.

Even with spam filtering enabled you could possibly be continuing to get spam email from one particular IP address, or even a range of IP addresses. Using user level or account level mail filtering in cPanel is a great way to stop this type of activity from happening!

Account level mail filter to block IP range

In this example, I'm going to be using a fictional IP range of [256.256.256.0 - 256.256.256.256] and adding that to an account level mail filter in cPanel, so that I don't receive anymore spam from any users on that network.

  1. Login to your cPanel.
  2. Under the Mail section, click on Account Level Filtering.
  3. Click on Create a New Filter.
  4. Name the filter Block IPs, under the Rules section change the From drop-down to Any header, and change the equals drop-down to contains.

    In the field below those type in 256.256.256. or the beginning of the IP address range you'd like to block, or just a full single IP address to block just one.

  5. Under the Actions section, you can leave it set to Discard Message to simply discard it, or select one of the other actions.
  6. Finally click on Create.

That's all there is to it, and you should now know how to block IP addresses from sending you email on an account level!

Did you find this article helpful?

We value your feedback!

Why was this article not helpful? (Check all that apply)
The article is too difficult or too technical to follow.
There is a step or detail missing from the instructions.
The information is incorrect or out-of-date.
It does not resolve the question/problem I have.
How did you find this article?
Please tell us how we can improve this article:
Email Address
Name

new! - Enter your name and email address above and we will post your feedback in the comments on this page!

Like this Article?

Related Questions

Here are a few questions related to this article that our customers have asked:
Ooops! It looks like there are no questions about this page.
Would you like to ask a question about this page? If so, click the button below!
Ask a Question
n/a Points
2014-04-10 4:43 pm

You show how to block a pretty simple range.

How do I block a range like...

80.79.0.0 – 83.167.255.255

 

Thanks!

Staff
9,962 Points
2014-04-10 5:45 pm
Hello Ken, and thanks for the great question!

You can also block wider IP ranges utilizing RegEx or regular expressions.

In your case you'd need to create 4 separate rules with Any header and matches regex to cover the entire range of IPs.

80\.0*(79|[89][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.\d{1,3}\.\d{1,3}
81\.\d{1,3}\.\d{1,3}\.\d{1,3}
82\.\d{1,3}\.\d{1,3}\.\d{1,3}
83\.0*([0-9]{1,2}|1[0-5][0-9]|16[0-7])\.\d{1,3}\.\d{1,3}


It looks pretty complicated, but breaks down like so:

To block the range 80.79.0.0 - 80.255.255.255 the first rule starts out with 80 the rest of the rule ensures that is followed by a number from 79 - 255, and then the two d{1,3} rules match 0 - 255 for the next two octets of the IP address.

To block the range 81.0.0.0 - 81.255.255.255 the second rule starts out with 81, followed by three sets of d{1,3} matching 0 - 255 in the next 3 octets.

To block the range 82.0.0.0 - 82.255.255.255 the third rule starts out with 82, followed by three sets of d{1,3} matching 0 - 255 in the next 3 octets.

Finally to block the range 88.167.0.0 - 88.167.255.255 the first rule starts out with 83 the rest of the rule ensures that is followed by a number from 0 - 167, and then the two d{1,3} rules match 0 - 255 for the next two octets of the IP address.

I hope that makes sense, please let us know if you're still having any issues receiving mail from these IP ranges after creating these mail filters.

- Jacob
n/a Points
2014-04-10 7:05 pm

Hi Jacob,

Thanks! I figured there must be a way!

I hate to turn this into a regex class, but can you explain how to come up with the regex ? I have a number of ranges I want to block.

I did find an online converter ( http://www.analyticsmarket.com/freetools/ipregex ) but it comes up with different results from yours.  i.e.  80.79.0.0-80.255.255 comes out as...

^80\.(79|[8-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))\.([0-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))\.([0-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))$

or is that just a different way of saying the same as what you gave me?

 

Somewhat confused...

Staff
16,176 Points
2014-04-10 8:40 pm
Hello Ken,

As you said, we unfortunately cannot take the time to explain how to determine REGEX (REgular EXpressions) here in the comments. There many sources for tutorials online if you wish to pursue that route. Here's an example.

The expressions are different because Jacob was breaking it down in groups of octets. So, instead of giving a straight expression for ALL of the IPs in your given range, he broke it down into groups: 80.x.x.x-80.255.255.255, then another rule for 81.x.x.x-81.255.255.255, and so on. Notice that IP ranges aren't completely sequential. He did this to try to simplify the generation of the expression for you. As you may have noticed, the expression you were given just simply accounts for all of the possible IPs in the range that you inputted -it just does it in one long line as opposed to 4 groups in the manner that Jacob provided above.

I hope that helps to explain it! Let us know if you have any further questions.

Regards,
Arnel C.

n/a Points
2014-05-04 11:20 pm

How to block the IP address in gmail?

Staff
8,310 Points
2014-05-05 10:50 am
Hello Sanjay,

Thank you for your comment. Unfortunately, google doesn't allow you to block IP addresses, as is explained in this post in the google forums.

What are you trying to accomplish? There may be a workaround, or alternate solution we can help you with.

If you have any further questions, feel free to post them below.
Thank you,

-John-Paul
n/a Points
2014-06-12 9:52 am

I have issue where someone is using my own email address to send me junk mail and when I try to use the block feature from withing outlook express I get a responce of

You cannot block your own email address

any suggestions?

Staff
8,065 Points
2014-06-12 10:02 am
SPF records will allow the mail server to identify the sender, allowing SpamAssassin to catch any spam coming from servers that are not authorized to send mail from your domain.
n/a Points
2014-06-12 10:24 am

Thanks I will try it, I though that was pretty sneaky  the way they masked there email address to be my own, Im glad theres a way to deal with this issue.

n/a Points
2014-08-06 4:20 pm

Help!  These instructions for blocking the IP address sound pretty straightforward, but can anyone explain how to actually find the IP address of spam emails?  I have so many per day now, whereas I didn't have any before.  Thank you!

Staff
8,310 Points
2014-08-06 4:52 pm
Hello Cheryl,

Thank you for your question. The IP address is sometimes included in the headers of the email.

Please keep in mind that spam is often sent from a compromised email account, so the IP addresses may not be consistent.

I recommend reading our Class on Dealing with Spam. It goes over several tools and information on combating spam emails.

If you have any further questions, feel free to post them below.
Thank you,

-John-Paul
n/a Points
2014-08-06 5:15 pm

Thank you John-Paul.  I will check it out

Post a Comment

Name:
Email Address:
Phone Number:
Comment:
Submit

Please note: Your name and comment will be displayed, but we will not show your email address.

12 Questions & Comments

Post a comment

Back to first comment | top

Need more Help?

Search

Ask the Community!

Get help with your questions from our community of like-minded hosting users and InMotion Hosting Staff.

Current Customers

Chat: Click to Chat Now E-mail: support@InMotionHosting.com
Call: 888-321-HOST (4678) Ticket: Submit a Support Ticket

Not a Customer?

Get web hosting from a company that is here to help. Sign up today!