Bob Proulx wrote:
The following header line:
Received: from static-96-254-126-11.tampfl.fios.verizon.net
[96.254.126.11] by
windows12.uvault.com with SMTP; Wed, 12 Aug 2009 08:26:40 -0400
Hits the HELO_DYNAMIC_IPADDR rule. I tested it this way:
$ perl -le 'if ("static-96-254-126-11.tampfl.fios.verizon.net" =~
/[a-z]\S*\d+[^\d\s]\d+[^\d\s]\d+[^\d\s]\d+[^\d\s][^\.]*\.\S+\.\S+[^\]]+/) { print "Yes" } else {
print "No" };'
Yes
But the address doesn't appear to be in a dynamic block. And it
doesn't look like a dynamic address pattern to me.
says 'static', but, a serious question: is the mail server at that ip
REALLY setup with a FQDN of
static-96-254-126-11.tampfl.fios.verizon.net
the helo_dynamic_ipaddr rule also catches 'static' ip addresses used by
spambots that are operating on static workstation ip addresses.
if this is a client of yours, you might help them get a VALID RDNS and
setup the FQDN for their mail server.
(more likely, its a zombie spambot anyway, )
Bob
_________________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r).
For Information please see http://www.secnap.com/products/spammertrap/
_________________________________________________________________________
