even if I really like the idea of country profiling, I am not shure if it wont be contraproductive. The risks of false detections grows IMO up with that.
And it sounds like a bit racism to me too. ;-) Christian > -----Ursprungliche Nachricht----- > Von: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Im Auftrag > von GrayHat > Gesendet: Montag, 22. Oktober 2007 12:46 > An: Questions and Answers for users of ASSP Anti-Spam SMTP Proxy > Betreff: Re: [Assp-user] Idea: country scoring > > > >> Could it be done ? And.. is it worth ? > > > Country profiling can be done. > > good to hear > > > I think we should look into the results of the currrent > > implementation, which is much simpler but also with a twist ))). > > ok, will do :) and since we're at it, here's something > which may be worth some investigation > > Running 1.3.5 and looking at the log I see entries > like > > Oct-22-07 12:28:42 id-8915c8104 [SenderBase][scoring] > 88.254.9.182 <[EMAIL PROTECTED]> to: [EMAIL PROTECTED] SenderBase > scoring: Turk Telekom (TR) > > and that's ok, then I also see entries like > > Oct-22-07 12:38:47 id-9526c7705 [SenderBase][scoring] > 85.33.63.252 <[EMAIL PROTECTED]> to: [EMAIL PROTECTED] SenderBase > scoring: Organization missing > > but running a DNS lookup on the second IP i get > > dig 252.63.33.85.test.senderbase.org TXT > > ;; QUESTION SECTION: > ;252.63.33.85.test.senderbase.org. IN TXT > > ;; ANSWER SECTION: > 252.63.33.85.test.senderbase.org. 20220 IN TXT "0-0=1|1=LABS > SRL|2=2.2|3=2.4|4= > 2981843|6=1171741053|20=host252-63-static.33-85-b.business.|21 > =telecomit > alia.it| > 22=Y|23=8.5|24=8.3|25=1049184000|40=2.2|41=2.4|43=1.9|44=0.12| > 45=N|46=29 > |48=29|4 > 9=1.00|50=Rome|51=07|53=IT|54=12.4833|55=41.9" > > so the organization is not missing ... I wonder if there's a > bug sitting somewhere... also, even if the org is missing, > why doesn't ASSP at least log the country ID ? > > > -------------------------------------------------------------- > ----------- > This SF.net email is sponsored by: Splunk Inc. > Still grepping through log files to find problems? Stop. > Now Search log events and configuration files using AJAX and > a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ _______________________________________________ Assp-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/assp-user ------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ _______________________________________________ Assp-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/assp-user
