Re: Multiple RBLs and dynamic IPs

[Reindl Harald]

Am 30.05.2016 um 18:11 schrieb RW:

On Mon, 30 May 2016 14:12:27 +0200
Reindl Harald wrote:

Am 30.05.2016 um 14:10 schrieb Matthias Leisi:

Hm, that looks odd:

Am 27.05.2016 um 20:15 schrieb Alex <mysqlstud...@gmail.com
<mailto:mysqlstud...@gmail.com>>:

X-Spam-Report:
* -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at
http://www.dnswl.org/, no
*      trust
*      [116.251.209.92 listed in list.dnswl.org
<http://list.dnswl.org>]

---------------------^

*  0.0 RCVD_IN_XBL_ALL RBL: Received via a relay in Spamhaus
SBL-XBL
*      [180.178.104.22 listed in mykey.zen.dq.spamhaus.net
<http://mykey.zen.dq.spamhaus.net>]

---------------------^

Why do these two different IPs show up? _NONE for 116.251.209.92
does not add any points, but if that IP ever gets a higher score at
dnswl.org <http://dnswl.org>, then it may effect the accuracy of
your spamfilter.

Is that a legitimate forwarder IP?

"RCVD_IN_XBL_ALL" smells like deep header inspection

The question was:

  "How many points do you add to an email that  *originated*
   from a dynamic IP that [is] on a number of blacklists?"

no - that was the question of the OP
i responded long ago with config values

the question above is a different one while i can't parse it completly

Am 27.05.2016 um 20:15 schrieb Alex:
> How many points do you add to an email that originated from a dynamic
> IP that on a number of blacklists?
>
> This 180.178.104.22 is an IP from a customer in Indonesia:
>
> Received: from [180.178.104.22] (port=51022 helo=CapriciousDude)
>         by vio1.naveca.biz with esmtpa (Exim 4.87)
>         (envelope-from <i...@example.com>)
>         id 1b6FMu-00087L-42; Fri, 27 May 2016 18:51:52 +0800
>
> This IP is on virtually every blacklist, but it doesn't necessarily
> mean it's the result of something this particular customer/user did




+----------------+-------------------------------+
| spamass_weight | alias                         |
+----------------+-------------------------------+
|            6.5 | pbl.spamhaus.org              |
|            6.5 | dul.dnsbl.sorbs.net           |
|            6.5 | noserver.dnsbl.sorbs.net      |
|            5.5 | smtp.dnsbl.sorbs.net          |
|            5.5 | xbl.spamhaus.org              |
|              5 | b.barracudacentral.org        |
|              5 | dnsbl.inps.de                 |
|              5 | css.spamhaus.org              |
|            4.5 | web.dnsbl.sorbs.net           |
|            3.5 | hostkarma.junkemailfilter.com |
|            2.5 | ix.dnsbl.manitu.net           |
|            2.5 | psbl.surriel.com              |
|            2.5 | dnsrbl.swinog.ch              |
|            2.5 | bl.spameatingmonkey.net       |
|            2.5 | bl.spamcop.net                |
|            1.5 | senderscore.com High          |
|            1.5 | hostkarma.junkemailfilter.com |
|            1.5 | block.dnsbl.sorbs.net         |
|            1.5 | bl.spamcannibal.org           |
|            1.5 | zombie.dnsbl.sorbs.net        |
|            1.5 | spam.dnsbl.sorbs.net          |
|            1.5 | sbl.spamhaus.org              |
|              1 | senderscore.com Medium        |
|              1 | bl.nszones.com                |
|              1 | http.dnsbl.sorbs.net          |
|              1 | socks.dnsbl.sorbs.net         |
|              1 | spam.spamrats.com             |
|              1 | misc.dnsbl.sorbs.net          |
|              1 | dnsbl-1.uceprotect.net        |
|              1 | dnsbl-2.uceprotect.net        |
|            0.5 | hostkarma.junkemailfilter.com |
|            0.5 | virus.dnsbl.sorbs.net         |
|            0.1 | ips.backscatterer.org         |
+----------------+-------------------------------+

don't matter - a enduser IP has no business to deliver mail on port 25 anywhere

signature.asc
Description: OpenPGP digital signature