Scroll Top
Evotec Services sp. z o.o., ul. Drozdów 6, Mikołów, 43-190, Poland
+48 502 469 760
[email protected]

PSBlackListChecker – Notifications to Microsoft Teams, Slack of Blacklisted IPs

PSBlackListChecker – Notifications to Microsoft Teams, Slack of Blacklisted IPs
PSBlackListChecker
By Przemyslaw Klys Exchange PowerShell Windows 2 listopada, 2018

If this is the first time you're reading about this module, it's simple PowerShell module that allows you to verify whether your IP address is on a blacklist or not. As you may know (or not know) there are over 80 blacklists run by multiple companies, organizations and having IP on their lists can cripple your mail flow heavily. Whether it's Microsoft Exchange or some other type of SMTP server, having an IP address that has a decent reputation is a must. This module won't fix your status but, it will allow you to monitor if your IP ever gets added to one of those lists so you can act upon it.

What's new

This new version takes old features and builds on top of it. It now can send notifications to Microsoft Teams, Slack but it's a bit faster, especially on a higher amount of IPs to check. This version changes your CONFIGURATION file. If you use this module already, please check new version below.

PSBlackListChecker Information
Please notice this article contains parts of information (still useful) and may not reflect all functionalities of this module. For download, source code and so on you should refer to the dedicated PSBlackListChecker module page. After reading this one of course! It contains useful information, examples, and know-how. Without it, you may not know all the features.

To make sure you don't take my word for it I've actually spent some time and you can choose the way you want to use Search-Blacklist with. The newest version comes with parameter RunType which allows you to choose one of 6 parameters

NoWorkflowAndRunSpaceNetDNS – Basic check. Doesn't use WorkFlow or Runspaces. Uses [Net.DNS] command.
NoWorkflowAndRunSpaceResolveDNS – Basic check. Doesn't use WorkFlow or Runspaces. Uses Resolve-DNS command.
WorkflowWithNetDNS – Basic check. Uses WorkFlow. Uses [Net.DNS] command.
WorkflowResolveDNS – Basic check. Uses WorkFlow. Uses Resolve-DNS command.
RunSpaceWithNetDNS – Basic check. Uses Runspaces. Uses [Net.DNS] command.
RunSpaceWithResolveDNS – Basic check. Uses Runspaces. Uses Resolve-DNS command.

While as you can imagine there's not much benefit to having all those choices… I wanted to verify the difference between Workflow, Runspaces and [Net.DNS] vs newer Resolve-DNS. You can find some results below:

Results of searching for 4 IPs on about 80 blacklists. As you can see below Runspaces are much faster to what is offered by Workflow and to what is available without it. What's a bit surprising is that [Net.DNS] is faster on Runspaces than Resolve-DNS at the same time losing heavily with Resolve-DNS when using Workflow. Of course, there may be some other conditions that play it, or maybe some small differences in implementation but it would seem Resolve-DNS is a bit slower than using Net.DNS but I still decided to use it due to modern functionality.

With just 1 IP the differences aren't as visible and are a bit different allowing Resolve-DNS to score few points more in comparison to Net.DNS. Of course, Runspaces win this one too. Actually, for Runspaces there seemed to be marginal change. In the end, it all doesn't matter. This tool is supposed to run in the background and doing this every 1 hour or so. Just in case you would like to test this out yourself be my guest. If you find inconsistencies in my testing, please let me know!

Clear-Host
Import-Module PSBlackListChecker -Force

$RunTypes = 'NoWorkflowAndRunSpaceNetDNS', 'NoWorkflowAndRunSpaceResolveDNS', 'WorkflowResolveDNS', 'WorkflowWithNetDNS', 'RunSpaceWithResolveDNS', 'RunSpaceWithNetDNS'

$IPs = '89.74.48.96' , '89.74.48.97', '89.74.48.98', '89.74.48.99'

$Results = @()
foreach ($RunType in $RunTypes) {
    Write-Color '[', 'start ', ']', ' Testing ', $RunType -Color White, Green, White, White, Yellow
    $StopWatch = [System.Diagnostics.Stopwatch]::StartNew()
    $BlackList = Search-BlackList -IP $IPs -RunType $RunType -ReturnAll
    $StopWatch.Stop()
    $BlackListListed = $BlackList | Where-Object { $_.Islisted -eq $true }
    $BlackListListed | Format-Table -AutoSize
    Write-Color '[', 'output', ']', ' Blacklist Count ', $Blacklist.Count, ' Blacklist Listed Count ', $($BlackListListed.Count) -Color White, Yellow, White, White, Gray, White, Green
    Write-Color '[', 'end   ', ']', ' Elapsed ', $RunType, ' minutes: ', $StopWatch.Elapsed.Minutes, ' seconds: ', $StopWatch.Elapsed.Seconds, ' Milliseconds: ', $StopWatch.Elapsed.Milliseconds -Color White, Red, White, White, Yellow, White, Yellow, White, Green, White, Green, White, Green

    $Results += [PsCustomObject][ordered]@{
        'RunType'           = $RunType
        'BlackList All'     = $Blacklist.Count
        'BlackList Found'   = $BlackListListed.Count
        'Time Minutes'      = $StopWatch.Elapsed.Minutes
        'Time Seconds'      = $StopWatch.Elapsed.Seconds
        'Time Milliseconds' = $StopWatch.Elapsed.Milliseconds
    }
}

$Results | Format-Table -Autosize
Manual Usage
Import-Module PSBlackListChecker #-Force

$IP = '89.74.48.96'
$IP1 = '89.74.48.97'
$MultipleIP = $IP, $IP1

Search-BlackList -IP $IP | Format-Table -AutoSize
Search-BlackList -IP $IP -ReturnAll | Format-Table -AutoSize

## Other ideas below

Search-BlackList -IP $IP -RunType RunSpaceWithResolveDNS | Format-Table -AutoSize
Search-BlackList -IP $IP -RunType RunSpaceWithNetDNS | Format-Table -AutoSize
Search-Blacklist -IP $IP -RunType WorkflowWithNetDNS | Format-Table -AutoSize
Search-Blacklist -IP $IP -RunType WorkflowResolveDNS | Format-Table -AutoSize
Search-Blacklist -IP $IP -RunType NoWorkflowAndRunSpaceNetDNS | Format-Table
Search-BlackList -IP $IP -ReturnAll | Format-Table -AutoSize
Search-BlackList -IP $IP -ReturnAll -SortBy IsListed -SortDescending $true
Search-BlackList -IP $MultipleIP -ReturnAll -SortBy Ip | Format-Table -AutoSize
Search-BlackList -IP $MultipleIP -ReturnAll -SortBy BlackList | Format-Table -AutoSize
Microsoft Teams support

As a heavy user, there could be no PSBlackListChecker without support for Microsoft Teams. If IP appears on a blacklist, it sends you a notification to channel of your choice, along with two buttons. First one allows you to confirm your findings on MxToolBox, the second one checks SMTP connectivity (also using MXToolBox – great tool btw!). Keep in mind that if you setup Scheduler to check for Blacklists every 5 minutes or every 1 hour, you will keep on getting notifications until your problem is solved or task scheduler is turned off. There may be a feature in future that would be able to detect this but not yet.

PSBlackListChecker

Slack Support

While I don't use Slack myself, I heard it's a good piece of software, so I'm adding it here. If you think display can be better feel free to contact me on GitHub and make a PR so we can improve the experience for everyone. When IP appears on the blacklist, you can also click Title of the message, and a website MXToolBox open.

PSBlackListChecker Information
Please notice this article contains parts of information (still useful) and may not reflect all functionalities of this module. For download, source code and so on you should refer to the dedicated PSBlackListChecker module page. After reading this one of course! It contains useful information, examples, and know-how. Without it, you may not know all the features.
Config file for reporting

A new version, new configuration file. While old one still should work to use new features you should use the newest version.

Import-Module PSBlackListChecker

$EmailParameters = @{
    EmailFrom            = "[email protected]"
    EmailTo              = "[email protected]" #
    EmailCC              = ""
    EmailBCC             = ""
    EmailServer          = ""
    EmailServerPassword  = ""
    EmailServerPort      = "587"
    EmailServerLogin     = ""
    EmailServerEnableSSL = 1
    EmailEncoding        = "Unicode"
    EmailSubject         = "[Reporting] Blacklist monitoring"
    EmailPriority        = "Low" # Normal, High
}
$FormattingParameters = @{
    CompanyBranding   = @{
        Logo   = "https://evotec.xyz/wp-content/uploads/2015/05/Logo-evotec-012.png"
        Width  = "200"
        Height = ""
        Link   = "https://evotec.xyz"
        Inline = $false
    }
    FontFamily        = "Calibri Light"
    FontSize          = "9pt"
    FontHeadingFamily = "Calibri Light"
    FontHeadingSize   = "12pt"
}
$ReportOptions = @{
    MonitoredIps       = @{
        Ip1 = '89.25.253.1'
        Ip2 = '188.117.129.1'
        # you can add as many Ip's as you want / IP1,2,3,4,5 etc
    }
    NotificationsEmail = @{
        Use                          = $false
        EmailPriorityWhenBlacklisted = 'High'
        EmailPriorityStandard        = 'Low'
        EmailAllResults              = $false
        EmailAlways                  = $true
        SortBy                       = 'IsListed' # Options: 'IP', 'BlackList', 'IsListed', 'Answer', 'FQDN
        SortDescending               = $true
    }
    NotificationsTeams = @{
        Use              = $false
        TeamsID          = ''
        MessageTitle     = 'IP Blacklisted'
        MessageText      = 'Everybody panic!'
        MessageImageLink = 'https://raw.githubusercontent.com/EvotecIT/PSTeams/master/Links/Asset%20130.png'
        MessageButtons   = $true
    }
    NotificationsSlack = @{
        Use            = $false
        Channel        = '#general'
        Uri            = ""
        MessageTitle   = 'IP Blacklisted'
        MessageText    = 'Everybody panic!'
        MessageButtons = $true
        MessageEmoji   = ':hankey:'  # Emoji List https://www.webpagefx.com/tools/emoji-cheat-sheet/
        MessageAsUser  = 'PSBlackListChecker'
    }
}

Start-ReportBlackLists -EmailParameters $EmailParameters -FormattingParameters $FormattingParameters -ReportOptions $ReportOptions
Przemyslaw Klys / About Author
System Architect with over 14 years of experience in the IT field. Skilled, among others, in Active Directory, Microsoft Exchange and Office 365. Profoundly interested in PowerShell. Software geek.
More posts by Przemyslaw Klys

Posty powiązane

Sending HTML emails with PowerShell and zero HTML knowledge required
I saw this article by Altaro tweeted Building PowerShell Tools for MSPs: HTML Tables for Reporting, and it describes how you can create HTML emails with just a few lines of code. Luke created that article in 2018 (tweets from the archive I guess), but I just saw it now so thought I would make a slight comparison. In 2018 I would probably go the same way as shown by Luke Orellana, who takes a simple example of querying WMI to get disk drive sizes and send them over, formatted via Email.
11 lip 2019
Difference between GetTempFileName() and GetRandomFileName() that got my ass kicked
Today’s story is about me making assumptions on how things work based on the method’s name. As the blog post says, I want to focus on two similar methods – GetTempFileName() and GetRandomFileName(), when using PowerShell. Still, since those methods are .NET based, it applies to a whole range of other languages – C#, F#, VisualBasic, and all others that I’ve never used.
24 sty 2022
Office 365 – The following error occurred during validation in agent Archive ParameterSet Enforcement Agent
26 wrz 2018
repadmin /replsummary
Active Directory Replication Summary to your Email or Microsoft Teams
Active Directory replication is a critical process that ensures the consistent and up-to-date state of directory information across all domain controllers in a domain. Monitoring this process is important as it helps identify any issues that may arise and resolve them quickly. One way to monitor Active Directory replication is by using the Repadmin command-line tool. Repadmin provides a wealth of information about the replication status and health of a domain. However, manually checking the Repadmin output can be time-consuming and tedious, and running it manually every 30 minutes just to check if everything is great doesn’t seem like a great idea. While PowerShell has its own commands around replication I’ve not found something as fast and reliable as repadmin /replsummary.
17 kwi 2024
Instant Replication between Active Directory sites with PowerShell
In Active Directory when you change something, it’s replicated to other Domain Controllers regularly. It’s a standard procedure that happens automatically in the background for you. It’s a handy feature because you can have multiple DC’s all over the world and have your users data in sync. You can change almost anything on DC nearest to you and be sure it will be the same value all over the place. But is it always the same? Well, it should be unless it isn’t. Today I was given a new migration from  Exchange to Office 365. I started with ADConnect installation and wanted to make sure that UserPrincipalNames have all UPNSuffixes in place.
21 lip 2019
PSTeams
Sending Messages to Microsoft Teams from PowerShell just got easier and better
Christmas time is upon us, and I’ve decided that my PSTeams module needs some love. I wrote it in late 2018 and updated it a few times at the beginning of 2019. This release hopefully is worth of having 1.0 version number. I don’t do that often and usually go for build numbers changes only, but Microsoft Teams message cards have their limits on functionality. Therefore, there are not many things that can be added unless Microsoft opens up and gives us all the cool features of Adaptive Cards. PSTeams module uses Webconnector to send messages to Teams. That method only supports Message Cards, which even Microsoft calls Legacy. But legacy doesn’t mean fully functional with some cool features of their own. If you’re new to PSTeams you may want to read those 2 posts below to get information how to set it up.
22 gru 2019
MicrosoftExchange
PowerShell – How to find users without default quota set on Microsoft Exchange
0
20 lis 2015
Getting Active Directory Last Backup Time using PowerShell
I shouldn’t be telling you that, but Active Directory Backup is an essential part of your Active Directory setup. When a backup of Active Directory happens, AD is aware of it. Following PowerShell solution allows you to get Active Directory Last Backup Time for the whole forest or by domain.
05 sie 2019
Invoke-RestMethod Error
Invoke-RestMethod : The underlying connection was closed: An unexpected error occurred on a send while connecting Graph API
In the last few days, I’ve got two reports that my PowerShell module for Office 365 Health suddenly started giving errors. This was a bit weird because it worked perfectly fine on my end. But while I could understand one person having an issue of their own, with their network or firewalls, if the second person comes along with the same report, that means something else is going on.
14 gru 2019
Restoring (Recovering) PowerShell Scripts from Event Logs
A few days ago, I was asked to take a look at PowerShell Malware. While I don’t know much about malware, my curiosity didn’t let me skip on this occasion, and I was handed over WindowsPowerShell.evtx file. Ok, that’s not what I expected! I wanted PowerShell .ps1 files that I can read and assess? Well, you play with the cards you were dealt with. What I was handed over was PowerShell Event Log. PowerShell writes whatever you execute, and it thinks it is risky, to Windows PowerShell Operation Event Log.
28 sie 2020
Update-Module : Module 'PowershellGet’ was not installed by using Install-Module, so it cannot be updated.
22 sie 2018
PowerShellBlack
Get-ADObject : The server has returned the following error: invalid enumeration context.
In the last weeks, I’m working on a PowerShell module that the main goal is to work on gathering and fixing GPOs. I’ve been testing my module a lot of times on my test environment, and it worked fine till the moment I run it on production, and it started to fail pretty quickly. The difference between my environment and production is 25 GPOs vs. 5000 GPOs. The error I was getting:
15 maj 2020
Environment Path
PowerShell – Environment Path is missing or overwritten
03 lis 2018
Using Win32_UserAccount WMI filter in PowerShell/Group Policies and what to avoid
Some months ago, I created PowerShell Script to create local administrative users on workstations – Create a local user or administrator account in Windows using PowerShell. It’s a bit overcomplicated, but the goal was it should work for Windows 7 and up, and that means supporting PowerShell 2.0. As part of that exercise, I’ve been using Win32_UserAccount WMI based query to find local users and manage them to an extent. While Get-LocalUser exists, it’s not suitable for the PowerShell 2.0 scenario. I also use the same query in GPO for WMI filtering. You can say it’s been a good friend of mine.
02 cze 2020
Active Directory – The directory service was unable to allocate a relative identifier
I’ve been testing Disaster Recovery scenario restoring Active Directory. One of the servers was restored, and it worked for a moment after restore. If you can regain your Primary DC, it’s best to do so. If you can’t, a standard thing to do during DR is to move all FSMO roles to the restored server so that it can become a master server. You can find out your FSMO holders by using those commands below:
27 mar 2019