Mailing List Archive: SpamAssassin: users

false positive on hostkarma blacklist

Index | Next | Previous | View Threaded

michael.monnerie at is

Oct 21, 2009, 11:39 AM

Post #1 of 4 (505 views)
Permalink

false positive on hostkarma blacklist

> http://ipadmin.junkemailfilter.com/remove.php?ip=62.40.128.130

Just received this FP from a customer. That IP is indeed an MX for
kabsi.at, a big cable provider in Austria. Please put it on YELLOW.

mfg zmi
--
// Michael Monnerie, Ing.BSc ----- http://it-management.at
// Tel: 0660 / 415 65 31 .network.your.ideas.
// PGP Key: "curl -s http://zmi.at/zmi.asc | gpg --import"
// Fingerprint: AC19 F9D5 36ED CD8A EF38 500E CE14 91F7 1C12 09B4
// Keyserver: wwwkeys.eu.pgp.net Key-ID: 1C1209B4

marc at perkel

Oct 21, 2009, 2:20 PM

Post #2 of 4 (467 views)
Permalink

Re: false positive on hostkarma blacklist [In reply to]

Fixed

Michael Monnerie wrote:

http://ipadmin.junkemailfilter.com/remove.php?ip=62.40.128.130"]http://ipadmin.junkemailfilter.com/remove.php?ip=62.40.128.130
Just received this FP from a customer. That IP is indeed an MX for kabsi.at, a big cable provider in Austria. Please put it on YELLOW. mfg zmi

michael.monnerie at is

Nov 11, 2009, 7:21 AM

Post #3 of 4 (414 views)
Permalink

Re: false positive on hostkarma blacklist [In reply to]

On Mittwoch 21 Oktober 2009 Marc Perkel wrote:
> Michael Monnerie wrote:
> http://ipadmin.junkemailfilter.com/remove.php?ip=62.40.128.130
> Just received this FP from a customer. That IP is indeed an MX for
> kabsi.at, a big cable provider in Austria. Please put it on YELLOW.

Please, Marc, you fixed above IP, but now this one is on the blacklist:
62.40.128.131

It's the following IP, and the reverse shows
62.40.128.130 mx02.kabsi.at
62.40.128.131 mx04.kabsi.at

When someone reports an ISP, and they name their MX in a very readable
way, you should automatically check for mx01 and mx03, mx05, ...
automatically:
195.202.128.130 mx03.kabsi.at
195.202.128.131 mx05.kabsi.at

Please put all these on YELLOW.

mfg zmi
--
// Michael Monnerie, Ing.BSc ----- http://it-management.at
// Tel: 0660 / 415 65 31 .network.your.ideas.
// PGP Key: "curl -s http://zmi.at/zmi.asc | gpg --import"
// Fingerprint: AC19 F9D5 36ED CD8A EF38 500E CE14 91F7 1C12 09B4
// Keyserver: wwwkeys.eu.pgp.net Key-ID: 1C1209B4

michael.monnerie at is

Nov 11, 2009, 7:25 AM

Post #4 of 4 (399 views)
Permalink

Re: false positive on hostkarma blacklist [In reply to]

Another FP, reported some Monday from a customer:
212.62.57.38 == mtaout3.isp.ptt.rs

Which is a clear sign for an ISP. So please, again, check also their
mtaout1 ... mtaout9 or whatever and include all these in YELLOW.

Also, I've offered you a list of ISPs MX from Austria. We have an ISP
Associtation ( www.ispa.at ), and they keep that list actual. Do you
want that for your YELLOW list? Maybe you can subscribe for receiving
updates automatically, too...

mfg zmi
--
// Michael Monnerie, Ing.BSc ----- http://it-management.at
// Tel: 0660 / 415 65 31 .network.your.ideas.
// PGP Key: "curl -s http://zmi.at/zmi.asc | gpg --import"
// Fingerprint: AC19 F9D5 36ED CD8A EF38 500E CE14 91F7 1C12 09B4
// Keyserver: wwwkeys.eu.pgp.net Key-ID: 1C1209B4

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads