Hi Scott:
Thank you for your quick response.
>> >Received: from watson (mitax3-237.dialup.optusnet.com.au
[198.142.115.237])
>> This one is a problem because an Australian company somehow managed to
get an IP address range through ARIN (which doesn't handle Australian
domains). There's not much that can be done about this one. <<
I'm not sure how you are processing the information, but you are of cause
correct - a .au domain us using an address is not in the APNIC range of
numbers.
But I wonder if that is really that unusual. I'm hosting several RIPE
country code sites (such as .cc, .de, .at) - and, if they co-locate a server
with me or use dedicating hosting, they could very well have a .cc, .de, .at
SMTP server with an IP address that is within the ARIN block not the RIPE
block?
(It's possible that I'm misunderstanding what exactly you're doing - I just
want to make sure that your test is actually feasible.)
Best Regards
Andy
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of R. Scott Perry
Sent: Tuesday, May 15, 2001 10:27 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] SPAMROUTING - 3 false positive samples
>05/15/2001 03:04:26 Qd4eb2e0 Msg failed SPAMROUTING (spam routing
>[20000103]).
>05/15/2001 03:04:26 Qd4eb2e0 Subject: nun geht's los
>05/15/2001 03:04:26 Qd4eb2e0 From: [EMAIL PROTECTED] To:
>[EMAIL PROTECTED]
>
>Received: from 192.168.115.2:1381
> by KEN! (0.0.0.0:25) with SMTP
> Tue May 15 08:30:28 2001 +0200
Here's the problem with this one. The server is reporting an IP address of
0.0.0.0, which isn't valid. The next release will treat 0.0.0.0 as a
private IP address.
>05/15/2001 08:21:36 Q1f3f2d0 Msg failed SPAMROUTING (spam routing
>[20000103]).
>05/15/2001 08:21:36 Q1f3f2d0 Subject: Photo from Wakefield Park 6/5/01
>05/15/2001 08:21:36 Q1f3f2d0 From: [EMAIL PROTECTED] To:
>[EMAIL PROTECTED]
>
>Received: from watson (mitax3-237.dialup.optusnet.com.au [198.142.115.237])
> by mail001.syd.optusnet.com.au (8.11.1/8.11.1) with SMTP id
> f4FCKPe03124
> for <[EMAIL PROTECTED]>; Tue, 15 May 2001 22:20:26 +1000
This one is a problem because an Australian company somehow managed to get
an IP address range through ARIN (which doesn't handle Australian
domains). There's not much that can be done about this one.
>05/15/2001 04:10:12 Qe4472ec Msg failed SPAMROUTING (spam routing
>[20000103]).
>05/15/2001 04:10:12 Qe4472ec Subject: NABISCO DIAL & STOCK ON #1396
>05/15/2001 04:10:12 Qe4472ec From: [EMAIL PROTECTED] To:
>[EMAIL PROTECTED]
>
>Received: from 192.168.0.53
> by Proxy+; Tue, 15 May 2001 08:11:19 GMT
Declude was getting thrown off by the (private) IP address here that wasn't
in brackets. It recognized that it was an IP address, but didn't handle it
properly. It will be handled properly in the next release.
Good work -- two of the three of these false positives will be fixed for
the next release. And, some work will be done on figuring out if there is
a way to detect overseas IP addresses that are registered with ARIN.
-Scott
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". You can E-mail
[EMAIL PROTECTED] for assistance. You can visit our web
site at http://www.declude.com .
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". You can E-mail
[EMAIL PROTECTED] for assistance. You can visit our web
site at http://www.declude.com .
