Wim Borghs wrote:
> ASSP version 1.2.5(18)
>
> Sep-30-06 xx:xx:xx PB: 209.51.143.0 score: 60+20 => 80
> reason:209.51.143.203:BlacklistedDomain
> Sep-30-06 xx:xx:xx 209.51.143.203 <[EMAIL PROTECTED]> to:
> [EMAIL PROTECTED] has blacklisted domain -> corpus/spam/12316.eml

Thanks for all your replies so far, Wim.  I truly appreciate that 
someone is taking the time to check on this and respond to the issue.

I believe the PB/blackListedDomains issue relates specifically to the 
matching of sub-domains.  Here are the details of one particular example:

I have had repeated spam coming in from <random>@avon.com, so I have 
long since had "avon.com" listed in my blackListedDomains.  This was 
working fine for a very long time, until recently when they changed the 
sending address to @shop.avon.com. Although the message itself has the 
injected ASSP header of  "X-Assp-Spam-Reason: Has blacklisted domain", 
here is what my logs say:

Oct-4-06 06:37:31 Connected: 206.165.246.79:26320 -> X.X.X.X:25 -> 
X.X.X.X:26
Oct-4-06 06:37:31 206.165.246.79 <[EMAIL PROTECTED]> whitelisting 
triplet: (206.165.246.0,[EMAIL PROTECTED],[EMAIL PROTECTED]) waited: 2h 
1m 54s
Oct-4-06 06:37:31 206.165.246.79 <[EMAIL PROTECTED]> to: 
[EMAIL PROTECTED] has blacklisted domain -> 
c:/assp/corpus/normal/spam/8395.eml
Oct-4-06 06:37:31 206.165.246.79 <[EMAIL PROTECTED]> to: 
[EMAIL PROTECTED] deleting spamming whitelisted tuplet: 
(206.165.246.0,shop.avon.com) age: 0s
Oct-4-06 06:37:31 206.165.246.79 <[EMAIL PROTECTED]> to: 
[EMAIL PROTECTED] is disconnected

As you can see, there is no PB action taking place against this 
sub-domain match.  I have verified that the IP is never added to the PB 
table.

If anyone else could try to replicate this issue, I would appreciate it.


-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys -- and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Assp-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/assp-user

Reply via email to