Trend Micro Interscan Gateway Security Appliance M-Series ...

How InterScan Gateway Security Appliance Works
identify spam sources. NRS blocks spam at its source by validating the IP address of
the SMTP server sending the inbound mail to a list of IP addresses in the RBL and
QIL databases.
TABLE 2-3. RBL and QIL databases
NRS Resource Description
Real-Time Blackhole
List (RBL)
RBL is a database that contains the IP addresses of SMTP
servers that originate spam or are considered to be spam
open-relay hosts. InterScan Gateway Security Appliance categorizes
the IP addresses listed in the RBL as permanent
sources of spam.
QIL QIL is a database that contains the IP addresses of SMTP
servers that either originate spam or are considered to be
spam open-relay hosts. InterScan Gateway Security Appliance
categorizes the IP addresses listed in the QIL as impermanent
sources of spam. The IP addresses in this list change
frequently.
How Network Reputation Services Works
Network Reputation Services (NRS) blocks spam by comparing the IP address of an
SMTP server to lists containing the IP addresses of known spam distributors.
For example, user A, in Seattle, sends email to user B in Los Angeles. User B's
SMTP server is behind an InterScan Gateway Security Appliance and the NRS
service is enabled with the Low setting selected.When InterScan Gateway Security
Appliance receives the email sending from user A's SMTP server to user B's SMTP
server, it first checks Server A's IP address against the RBL database. If user A's
SMTP server IP address is not on the list, InterScan Gateway Security Appliance
sends the email to user B's SMTP server. However, if user A's SMTP server IP
address is on the list, InterScan Gateway Security Appliance takes the action that the
administrator defined in the Action settings screen.
If the administrator chose High setting in the Network Reputation Services screen,
InterScan Gateway Security Appliance first checks the IP address of user A's SMTP
server against the RBL database. If the SMTP server IP address is not in the RBL
database, InterScan Gateway Security Appliance then queries the QIL database. If
the SMTP server IP address is not in the QIL database, InterScan Gateway Security
Appliance forwards the email to user B's SMTP server. If the QIL database does have
2-11