Scroll Top
Evotec Services sp. z o.o., ul. Drozdów 6, Mikołów, 43-190, Poland
+48 502 469 760
[email protected]

PSBlackListChecker – Notifications to Microsoft Teams, Slack of Blacklisted IPs

PSBlackListChecker – Notifications to Microsoft Teams, Slack of Blacklisted IPs
PSBlackListChecker
By Przemyslaw Klys Exchange PowerShell Windows 2 listopada, 2018

If this is the first time you're reading about this module, it's simple PowerShell module that allows you to verify whether your IP address is on a blacklist or not. As you may know (or not know) there are over 80 blacklists run by multiple companies, organizations and having IP on their lists can cripple your mail flow heavily. Whether it's Microsoft Exchange or some other type of SMTP server, having an IP address that has a decent reputation is a must. This module won't fix your status but, it will allow you to monitor if your IP ever gets added to one of those lists so you can act upon it.

What's new

This new version takes old features and builds on top of it. It now can send notifications to Microsoft Teams, Slack but it's a bit faster, especially on a higher amount of IPs to check. This version changes your CONFIGURATION file. If you use this module already, please check new version below.

PSBlackListChecker Information
Please notice this article contains parts of information (still useful) and may not reflect all functionalities of this module. For download, source code and so on you should refer to the dedicated PSBlackListChecker module page. After reading this one of course! It contains useful information, examples, and know-how. Without it, you may not know all the features.

To make sure you don't take my word for it I've actually spent some time and you can choose the way you want to use Search-Blacklist with. The newest version comes with parameter RunType which allows you to choose one of 6 parameters

NoWorkflowAndRunSpaceNetDNS – Basic check. Doesn't use WorkFlow or Runspaces. Uses [Net.DNS] command.
NoWorkflowAndRunSpaceResolveDNS – Basic check. Doesn't use WorkFlow or Runspaces. Uses Resolve-DNS command.
WorkflowWithNetDNS – Basic check. Uses WorkFlow. Uses [Net.DNS] command.
WorkflowResolveDNS – Basic check. Uses WorkFlow. Uses Resolve-DNS command.
RunSpaceWithNetDNS – Basic check. Uses Runspaces. Uses [Net.DNS] command.
RunSpaceWithResolveDNS – Basic check. Uses Runspaces. Uses Resolve-DNS command.

While as you can imagine there's not much benefit to having all those choices… I wanted to verify the difference between Workflow, Runspaces and [Net.DNS] vs newer Resolve-DNS. You can find some results below:

Results of searching for 4 IPs on about 80 blacklists. As you can see below Runspaces are much faster to what is offered by Workflow and to what is available without it. What's a bit surprising is that [Net.DNS] is faster on Runspaces than Resolve-DNS at the same time losing heavily with Resolve-DNS when using Workflow. Of course, there may be some other conditions that play it, or maybe some small differences in implementation but it would seem Resolve-DNS is a bit slower than using Net.DNS but I still decided to use it due to modern functionality.

With just 1 IP the differences aren't as visible and are a bit different allowing Resolve-DNS to score few points more in comparison to Net.DNS. Of course, Runspaces win this one too. Actually, for Runspaces there seemed to be marginal change. In the end, it all doesn't matter. This tool is supposed to run in the background and doing this every 1 hour or so. Just in case you would like to test this out yourself be my guest. If you find inconsistencies in my testing, please let me know!

Clear-Host
Import-Module PSBlackListChecker -Force

$RunTypes = 'NoWorkflowAndRunSpaceNetDNS', 'NoWorkflowAndRunSpaceResolveDNS', 'WorkflowResolveDNS', 'WorkflowWithNetDNS', 'RunSpaceWithResolveDNS', 'RunSpaceWithNetDNS'

$IPs = '89.74.48.96' , '89.74.48.97', '89.74.48.98', '89.74.48.99'

$Results = @()
foreach ($RunType in $RunTypes) {
    Write-Color '[', 'start ', ']', ' Testing ', $RunType -Color White, Green, White, White, Yellow
    $StopWatch = [System.Diagnostics.Stopwatch]::StartNew()
    $BlackList = Search-BlackList -IP $IPs -RunType $RunType -ReturnAll
    $StopWatch.Stop()
    $BlackListListed = $BlackList | Where-Object { $_.Islisted -eq $true }
    $BlackListListed | Format-Table -AutoSize
    Write-Color '[', 'output', ']', ' Blacklist Count ', $Blacklist.Count, ' Blacklist Listed Count ', $($BlackListListed.Count) -Color White, Yellow, White, White, Gray, White, Green
    Write-Color '[', 'end   ', ']', ' Elapsed ', $RunType, ' minutes: ', $StopWatch.Elapsed.Minutes, ' seconds: ', $StopWatch.Elapsed.Seconds, ' Milliseconds: ', $StopWatch.Elapsed.Milliseconds -Color White, Red, White, White, Yellow, White, Yellow, White, Green, White, Green, White, Green

    $Results += [PsCustomObject][ordered]@{
        'RunType'           = $RunType
        'BlackList All'     = $Blacklist.Count
        'BlackList Found'   = $BlackListListed.Count
        'Time Minutes'      = $StopWatch.Elapsed.Minutes
        'Time Seconds'      = $StopWatch.Elapsed.Seconds
        'Time Milliseconds' = $StopWatch.Elapsed.Milliseconds
    }
}

$Results | Format-Table -Autosize
Manual Usage
Import-Module PSBlackListChecker #-Force

$IP = '89.74.48.96'
$IP1 = '89.74.48.97'
$MultipleIP = $IP, $IP1

Search-BlackList -IP $IP | Format-Table -AutoSize
Search-BlackList -IP $IP -ReturnAll | Format-Table -AutoSize

## Other ideas below

Search-BlackList -IP $IP -RunType RunSpaceWithResolveDNS | Format-Table -AutoSize
Search-BlackList -IP $IP -RunType RunSpaceWithNetDNS | Format-Table -AutoSize
Search-Blacklist -IP $IP -RunType WorkflowWithNetDNS | Format-Table -AutoSize
Search-Blacklist -IP $IP -RunType WorkflowResolveDNS | Format-Table -AutoSize
Search-Blacklist -IP $IP -RunType NoWorkflowAndRunSpaceNetDNS | Format-Table
Search-BlackList -IP $IP -ReturnAll | Format-Table -AutoSize
Search-BlackList -IP $IP -ReturnAll -SortBy IsListed -SortDescending $true
Search-BlackList -IP $MultipleIP -ReturnAll -SortBy Ip | Format-Table -AutoSize
Search-BlackList -IP $MultipleIP -ReturnAll -SortBy BlackList | Format-Table -AutoSize
Microsoft Teams support

As a heavy user, there could be no PSBlackListChecker without support for Microsoft Teams. If IP appears on a blacklist, it sends you a notification to channel of your choice, along with two buttons. First one allows you to confirm your findings on MxToolBox, the second one checks SMTP connectivity (also using MXToolBox – great tool btw!). Keep in mind that if you setup Scheduler to check for Blacklists every 5 minutes or every 1 hour, you will keep on getting notifications until your problem is solved or task scheduler is turned off. There may be a feature in future that would be able to detect this but not yet.

PSBlackListChecker

Slack Support

While I don't use Slack myself, I heard it's a good piece of software, so I'm adding it here. If you think display can be better feel free to contact me on GitHub and make a PR so we can improve the experience for everyone. When IP appears on the blacklist, you can also click Title of the message, and a website MXToolBox open.

PSBlackListChecker Information
Please notice this article contains parts of information (still useful) and may not reflect all functionalities of this module. For download, source code and so on you should refer to the dedicated PSBlackListChecker module page. After reading this one of course! It contains useful information, examples, and know-how. Without it, you may not know all the features.
Config file for reporting

A new version, new configuration file. While old one still should work to use new features you should use the newest version.

Import-Module PSBlackListChecker

$EmailParameters = @{
    EmailFrom            = "[email protected]"
    EmailTo              = "[email protected]" #
    EmailCC              = ""
    EmailBCC             = ""
    EmailServer          = ""
    EmailServerPassword  = ""
    EmailServerPort      = "587"
    EmailServerLogin     = ""
    EmailServerEnableSSL = 1
    EmailEncoding        = "Unicode"
    EmailSubject         = "[Reporting] Blacklist monitoring"
    EmailPriority        = "Low" # Normal, High
}
$FormattingParameters = @{
    CompanyBranding   = @{
        Logo   = "https://evotec.xyz/wp-content/uploads/2015/05/Logo-evotec-012.png"
        Width  = "200"
        Height = ""
        Link   = "https://evotec.xyz"
        Inline = $false
    }
    FontFamily        = "Calibri Light"
    FontSize          = "9pt"
    FontHeadingFamily = "Calibri Light"
    FontHeadingSize   = "12pt"
}
$ReportOptions = @{
    MonitoredIps       = @{
        Ip1 = '89.25.253.1'
        Ip2 = '188.117.129.1'
        # you can add as many Ip's as you want / IP1,2,3,4,5 etc
    }
    NotificationsEmail = @{
        Use                          = $false
        EmailPriorityWhenBlacklisted = 'High'
        EmailPriorityStandard        = 'Low'
        EmailAllResults              = $false
        EmailAlways                  = $true
        SortBy                       = 'IsListed' # Options: 'IP', 'BlackList', 'IsListed', 'Answer', 'FQDN
        SortDescending               = $true
    }
    NotificationsTeams = @{
        Use              = $false
        TeamsID          = ''
        MessageTitle     = 'IP Blacklisted'
        MessageText      = 'Everybody panic!'
        MessageImageLink = 'https://raw.githubusercontent.com/EvotecIT/PSTeams/master/Links/Asset%20130.png'
        MessageButtons   = $true
    }
    NotificationsSlack = @{
        Use            = $false
        Channel        = '#general'
        Uri            = ""
        MessageTitle   = 'IP Blacklisted'
        MessageText    = 'Everybody panic!'
        MessageButtons = $true
        MessageEmoji   = ':hankey:'  # Emoji List https://www.webpagefx.com/tools/emoji-cheat-sheet/
        MessageAsUser  = 'PSBlackListChecker'
    }
}

Start-ReportBlackLists -EmailParameters $EmailParameters -FormattingParameters $FormattingParameters -ReportOptions $ReportOptions
Przemyslaw Klys / About Author
System Architect with over 14 years of experience in the IT field. Skilled, among others, in Active Directory, Microsoft Exchange and Office 365. Profoundly interested in PowerShell. Software geek.
More posts by Przemyslaw Klys

Posty powiązane

Upload and Download files from Azure Blob Storage using Connection String
They say there is a first time for everything. For me, it’s how to download and upload files to Azure Blog Storage using Connection String. Recently I was given Connection String, Container name and had to download some files from Azur Blog Storage. After some research and trying Connect-AzAccount, I found that the proper way to go is thru New-AzStorageContext.
18 sty 2023
Difference between GetTempFileName() and GetRandomFileName() that got my ass kicked
Today’s story is about me making assumptions on how things work based on the method’s name. As the blog post says, I want to focus on two similar methods – GetTempFileName() and GetRandomFileName(), when using PowerShell. Still, since those methods are .NET based, it applies to a whole range of other languages – C#, F#, VisualBasic, and all others that I’ve never used.
24 sty 2022
PSWinReporting - Find-Events
The only PowerShell Command you will ever need to find out who did what in Active Directory
While the title of this blog may be a bit exaggeration, the command I’m trying to show here does it’s best to deliver on the promise. What you’re about to witness here is something I’ve worked on for a while now, and it meets my basic needs. If you don’t have SIEM product or products that monitor who does what in Active Directory this command makes it very easy, even for people who don’t have much experience in reading Event Logs. If you’d like to learn about working with Windows Event Logs here’s a great article I wrote recently – PowerShell – Everything you wanted to know about Event Logs and then some.
28 kwi 2019
repadmin /replsummary
Active Directory Replication Summary to your Email or Microsoft Teams
Active Directory replication is a critical process that ensures the consistent and up-to-date state of directory information across all domain controllers in a domain. Monitoring this process is important as it helps identify any issues that may arise and resolve them quickly. One way to monitor Active Directory replication is by using the Repadmin command-line tool. Repadmin provides a wealth of information about the replication status and health of a domain. However, manually checking the Repadmin output can be time-consuming and tedious, and running it manually every 30 minutes just to check if everything is great doesn’t seem like a great idea. While PowerShell has its own commands around replication I’ve not found something as fast and reliable as repadmin /replsummary.
17 kwi 2024
Office 365 – The following error occurred during validation in agent Archive ParameterSet Enforcement Agent
26 wrz 2018
Instant Replication between Active Directory sites with PowerShell
In Active Directory when you change something, it’s replicated to other Domain Controllers regularly. It’s a standard procedure that happens automatically in the background for you. It’s a handy feature because you can have multiple DC’s all over the world and have your users data in sync. You can change almost anything on DC nearest to you and be sure it will be the same value all over the place. But is it always the same? Well, it should be unless it isn’t. Today I was given a new migration from  Exchange to Office 365. I started with ADConnect installation and wanted to make sure that UserPrincipalNames have all UPNSuffixes in place.
21 lip 2019
Visually display Active Directory Nested Group Membership using PowerShell
In the Active Directory PowerShell module, you have two commands to your disposal that help display group membership. Those are Get-ADGroup and Get-ADGroupMember. The first command contains property Members, which gives you DistinguishedName of all members, and Get-ADGroupMember can provide you either direct members or with Recursive switch all members recursively (skipping groups). Till a few weeks ago, I was a happy user of those commands until I noticed two things. Member property for Get-ADGroup sometimes misses elements for whatever reason.
02 wrz 2020
Install-Module : A parameter cannot be found that matches parameter name AllowPrerelease.
22 sie 2018
MicrosoftE xchange
Microsoft Exchange – Set Address Book Policy to multiple users based on group membership
0
28 sty 2016
Fixing Active Directory PasswordNotRequired with PowerShell
There was I, deploying PSPasswordExpiryNotifications for one of my Clients when I started getting complaints that some users are not getting their Password Expiry Notifications. Well, that’s a new one. I’ve tested this script multiple times, and it worked just fine. So I dive into the details of my script to see what I did in there (I don’t even remember anymore – it just works) to find out this little line:
25 cze 2019
Powerful hashtables
How I didn’t know how powerful and fast hashtables are
I’ve been using PowerShell for a long while now using Hashtables, OrderedDictionary, and other types of data types in PowerShell, but I never paid attention to how powerful those are. And I don’t mean your general knowledge about hashtables that is already covered by Kevin Marquette in his article Everything you wanted to know about Hashtables or my article PowerShell – Few tricks about HashTables and Arrays I wish I knew when I started. Let’s find out, how Powerful they are, shall we?
19 maj 2019
Monitoring User, Groups Changes in Active Directory – version 0.8
17 kwi 2018
PSWriteWord 0.4.1
PSWriteWord – Updated to 0.4.1 (Breaking Change included)
28 cze 2018
PowerShell – Single PSM1 file versus multi-file modules
I’ve been working with PowerShell Modules for a while now, and most of my knowledge about them came from Warren F (psCookieMonster) blog about Building a PowerShell Module. It is a handy piece of information and recommended read for anyone starting up writing PowerShell Modules. He introduces an idea where a module is stored in multiple folders Private, Public, Bin, Lib and so on and having YourModule.psm1 as a wrapper for functions, binaries in those folders, where each function is stored in its file. It’s an excellent concept, and I use it every day. It allows me to jump into a file quickly I want to find and fundamentally easier for development, especially in teams.
16 lis 2018
Function cannot be created because function capacity 4096 has been exceeded for this scope
Function cannot be created because function capacity 4096 has been exceeded for this scope
I had a long day today when my long-running script (10 hours) gave me weird errors with Microsoft Graph for Teams. Finally, I solved my mistakes and reran the hand to see if the report would be complete this time. Surprisingly, it gave me an error I’d never seen before. “Function cannot be created because function capacity 4096 has been exceeded for this scope”. The error is at least weird because it’s shown on a production server where I’ve just a handful of PowerShell modules installed, and I’ve never seen it on my development machine where I’ve over 200 modules.
01 sie 2023