1.     <#
  2.     .SYNOPSIS
  3.     CheckRLB.ps1 - Checks a list servers against a list of RBL and reports any occurrences.
  4.      
  5.     .DESCRIPTION
  6.     Checks a list servers or IP against a list of RBL and reports any occurrences.
  7.      
  8.     .INPUTS
  9.      
  10.     .OUTPUTS
  11.     Results are emailed
  12.      
  13.     .PARAMETER MXRecord
  14.     One or more servers or IP, separated by commas, to be checked against the RLB list.
  15.      
  16.     .PARAMETER Verbose
  17.     Detailed output from the script.
  18.      
  19.     .EXAMPLE
  20.     To check the host mx1.hotmail.com and aspmx.l.google.com against the blacklist:
  21.     CheckRLB.ps1 -MXRecord mx1.hotmail.com, aspmx.l.google.com
  22.      
  23.     .NOTES
  24.      
  25.     Make sure to change the MX records and SMTP settings to fit your needs.
  26.     #>
  27.    
  28. ##### VARIABLES TO MODIFY BELOW #####  
  29.    
  30.     $smtpServer = "smtp.domain.com"
  31.     $smtpTo = "HelpDesk@domain.com"
  32.     $smtpFrom = "EmailBlacklistCheck@domain.com"
  33.      
  34.     [CmdletBinding()]
  35.     Param(
  36.             [Parameter( Mandatory=$false)]
  37.             #List of MX records to monitor if the parameter is not changed
  38.             [string[]]$MXRecord = @(
  39.                     'mx1.hotmail.com'
  40.                     'mx2.hotmail.com'
  41.                     'mx3.hotmail.com'
  42.                     'mx4.hotmail.com'
  43.             )
  44.     )
  45.  
  46.     ##### VARIABLES TO MODIFY ABOVE #####
  47.  
  48.  
  49.     #List of RLB's to check against
  50.     $blacklistServers = @(
  51.         'b.barracudacentral.org'
  52.         'spam.rbl.msrbl.net'
  53.         'zen.spamhaus.org'
  54.         'bl.deadbeef.com'
  55.         'bl.emailbasura.org'
  56.         'bl.spamcannibal.org'
  57.         'bl.spamcop.net'
  58.         'blackholes.five-ten-sg.com'
  59.         'blacklist.woody.ch'
  60.         'bogons.cymru.com'
  61.         'cbl.abuseat.org'
  62.         'cdl.anti-spam.org.cn'
  63.         'combined.abuse.ch'
  64.         'combined.rbl.msrbl.net'
  65.         'db.wpbl.info'
  66.         'dnsbl-1.uceprotect.net'
  67.         'dnsbl-2.uceprotect.net'
  68.         'dnsbl-3.uceprotect.net'
  69.         'dnsbl.ahbl.org'
  70.         'dnsbl.cyberlogic.net'
  71.         'dnsbl.inps.de'
  72.         'dnsbl.njabl.org'
  73.         'dnsbl.sorbs.net'
  74.         'drone.abuse.ch'
  75.         'drone.abuse.ch'
  76.         'duinv.aupads.org'
  77.         'dul.dnsbl.sorbs.net'
  78.         'dul.ru'
  79.         'dyna.spamrats.com'
  80.         'dynip.rothen.com'
  81.         'http.dnsbl.sorbs.net'
  82.         'images.rbl.msrbl.net'
  83.         'ips.backscatterer.org'
  84.         'ix.dnsbl.manitu.net'
  85.         'korea.services.net'
  86.         'misc.dnsbl.sorbs.net'
  87.         'noptr.spamrats.com'
  88.         'ohps.dnsbl.net.au'
  89.         'omrs.dnsbl.net.au'
  90.         'orvedb.aupads.org'
  91.         'osps.dnsbl.net.au'
  92.         'osrs.dnsbl.net.au'
  93.         'owfs.dnsbl.net.au'
  94.         'owps.dnsbl.net.au'
  95.         'pbl.spamhaus.org'
  96.         'phishing.rbl.msrbl.net'
  97.         'probes.dnsbl.net.au'
  98.         'proxy.bl.gweep.ca'
  99.         'proxy.block.transip.nl'
  100.         'psbl.surriel.com'
  101.         'rbl.interserver.net'
  102.         'rdts.dnsbl.net.au'
  103.         'relays.bl.gweep.ca'
  104.         'relays.bl.kundenserver.de'
  105.         'relays.nether.net'
  106.         'residential.block.transip.nl'
  107.         'ricn.dnsbl.net.au'
  108.         'rmst.dnsbl.net.au'
  109.         'sbl.spamhaus.org'
  110.         'short.rbl.jp'
  111.         'smtp.dnsbl.sorbs.net'
  112.         'socks.dnsbl.sorbs.net'
  113.         'spam.abuse.ch'
  114.         'spam.dnsbl.sorbs.net'
  115.         'spam.spamrats.com'
  116.         'spamlist.or.kr'
  117.         'spamrbl.imp.ch'
  118.         't3direct.dnsbl.net.au'
  119.         'tor.ahbl.org'
  120.         'tor.dnsbl.sectoor.de'
  121.         'torserver.tor.dnsbl.sectoor.de'
  122.         'ubl.lashback.com'
  123.         'ubl.unsubscore.com'
  124.         'virbl.bit.nl'
  125.         'virus.rbl.jp'
  126.         'virus.rbl.msrbl.net'
  127.         'web.dnsbl.sorbs.net'
  128.         'wormrbl.imp.ch'
  129.         'xbl.spamhaus.org'
  130.         'zombie.dnsbl.sorbs.net'
  131.     )
  132.      
  133.      
  134.     $arrAttributes = @()        #Array to store failed checks on
  135.     $IPs = @()                  #Array to store IP addresses
  136.     $count1 = 1                 #Counter for the first progress bar
  137.      
  138.     foreach ($mx in $mxrecord){
  139.             #Main progress bar
  140.             $ActivityMessage = "Gathering the IP's for all of the MX records. Please wait..."
  141.             $StatusMessage = ("Processing {0} of {1}: {2}" -f $count1, @($mxrecord).count, $mx)
  142.             $PercentComplete = ($count1 / @($mxrecord).count * 100)
  143.             Write-Progress -ID 1 -Activity $ActivityMessage -Status $StatusMessage -PercentComplete $PercentComplete
  144.      
  145.             Write-Verbose "Getting IP addresses for the $mx"
  146.             $mxips = [System.Net.Dns]::GetHostAddresses("$mx")
  147.             $IPAddress = $mxips | select $_.IPAddressToString
  148.             $IPs += $IPAddress.IPAddressToString
  149.             $count1++
  150.     }
  151.      
  152.     #Filter the list of IPs down to only unigue entries
  153.     if ($IPs.count -gt 1){
  154.             $IPs += $IPs | select -Unique
  155.     }
  156.      
  157.     $count2 = 1                             #Counter for the second progress bar
  158.     foreach ($IP in $ips){
  159.             #Secondary progress bar
  160.             $ActivityMessage = "Processing IP's. Please wait..."
  161.             $StatusMessage = ("Processing {0} of {1}: {2}" -f $count2, @($ips).count, $ip)
  162.             $PercentComplete = ($count2 / @($ips).count * 100)
  163.             Write-Progress -ID 2 -Activity $ActivityMessage -Status $StatusMessage -PercentComplete $PercentComplete
  164.      
  165.             Write-Verbose "Forming reverse IP for $IP"
  166.             $reversedIP = ($IP -split '\.')[3..0] -join '.'
  167.             Write-Verbose "Reverse IP is $reversedIP"
  168.            
  169.             $count3 = 1                             #Counter for the third progress bar
  170.             foreach ($server in $blacklistServers){
  171.                     #Third progress bar
  172.                     $ActivityMessage = "Checking RLB. Please wait..."
  173.                     $StatusMessage = ("Processing {0} of {1}: {2}" -f $count3, @($blacklistServers).count, $server)
  174.                     $PercentComplete = ($count3 / @($blacklistServers).count * 100)
  175.                     Write-Progress -ID 3 -ParentId 2 -Activity $ActivityMessage -Status $StatusMessage -PercentComplete $PercentComplete
  176.      
  177.                     $objAttributes = New-Object PSObject
  178.                    
  179.                     #Combine the reverse IP with the server checking
  180.                     $fqdn = "$reversedIP.$server"
  181.      
  182.                     try {
  183.                         Write-Verbose "Checking $IP against $server"
  184.                             $null = [System.Net.Dns]::GetHostEntry($fqdn)
  185.                             $helplink = "http://mxtoolbox.com/SuperTool.aspx?action=blacklist%3a" + $IP
  186.                             Add-Member -InputObject $objAttributes -MemberType NoteProperty -Name IP -Value $IP
  187.                             Add-Member -InputObject $objAttributes -MemberType NoteProperty -Name "Blacklisted On" -Value $server
  188.                             Add-Member -InputObject $objAttributes -MemberType NoteProperty -Name "MX Record" -Value $MX
  189.                             Add-Member -InputObject $objAttributes -MemberType NoteProperty -Name "MXToolbox Link" -Value $helplink
  190.                             $arrAttributes += $objAttributes
  191.                     }
  192.                     catch { }
  193.                     $count3++
  194.             }      
  195.             $count2++
  196.     }
  197.      
  198.      
  199.     #Email Settings
  200.      
  201.     $date = Get-Date -Format g
  202.  
  203.     $messageSubject = "An IP Has Been Listed On An Email Blacklist - $date"
  204.      
  205.     #CSS style for the HTML message
  206.     $emailhead="<html>
  207.               <style>
  208.               BODY{font-family: Calibri; font-size: 11pt;}
  209.               H1{font-size: 18px;}
  210.               H2{font-size: 16px;}
  211.               H3{font-size: 14px;}
  212.               TABLE{border: 1px solid black; border-collapse: collapse; font-size: 11pt;}
  213.               TH{border: 1px solid black; background: #dddddd; padding: 5px; color: #000000;}
  214.               TD{border: 1px solid black; padding: 5px; }
  215.               </style>"
  216.      
  217.     #Main body of the email, tailor to fit needs
  218.     $emailbody = "<body>
  219.                              <h3 align=""center"">An IP Has Been Listed On An Email Blacklist</h3>
  220.                              <p>The IP's below have been blacklisted please check the MXToolbox link for more information.</p>"
  221.      
  222.     #Convert the array to HTML
  223.     $emailtable = $arrAttributes | ConvertTo-Html
  224.      
  225.     #Closing tags and when/where the report was generated
  226.     $emailbottom = "<p>Generated at $date on $(Get-Content env:computername)</p>
  227.                                    </body>
  228.                                    </html>"
  229.      
  230.     #Combine all the parts together to make one pretty email
  231.     $htmlmessage = $emailhead + $emailbody + $emailtable + $emailbottom
  232.      
  233.     #Check if there was a hit create an email
  234.     if ($arrAttributes -ne $null){
  235.             Write-Verbose "An IP was BlackListed, sending an email to $smtpTo"
  236.             Send-MailMessage -To $smtpTo -From $smtpFrom -SmtpServer $smtpServer -Priority High -Subject $messageSubject -BodyAsHtml -Body $htmlMessage
  237.     }