Block specified marketing sites and IP addresses
mkting
- BLOCKED range 64.119.202.1 - 64.119.202.254
- server1.lrbmkting.com(64.119.202.169)
- server1.ltsmkting.com(64.119.202.170)
- server1.lttmkting.com(64.119.202.171)
- server1.luwmkting.com(64.119.202.172)
- BLOCKED range 216.140.54.1 - 216.140.54.254
- server1.qmcmkting.com(216.140.54.104)
- server1.qpgmkting.com(216.140.54.105)
- server1.reemkting.com(216.140.54.107)
- server1.qxamkting.com(216.140.54.106)
- server1.selmkting.com(216.140.54.109)
- BLOCKED range 69.36.193.1 - 69.36.193.254
- server1.wlnmkting.com(69.36.193.75)
- server1.nbvmkting.com(69.36.193.83)
- server1.owdmkting.com(69.36.193.85)
- server1.piqmkting.com(69.36.193.86)
GoToMyPC
66.151.158.177 - GoToMyPC executable making this access - BLOCKED
212.118.246.76 - Extercity (GoToMyPC)
General rubbish
- 64.74.80.187 - BLOCKED
- nl.ct001.com(209.240.140.132): 123greetings.com (Eliz has con contact with them)
- www.my0.co.uk(195.102.82.41) - email bureau - BLOCKED by name
- www.a79z.com(64.119.212.174) - markedmail.com - BLOCKED by name
MyDoom
MyDoom opens TCP ports 3127 through 3198, presumably to listen for instructions from the worm's author
check traffic on the ports, so these ports should also be blocked.