Someone sending to us received the following error (we are using Spam Filter 3.5.4.730).

 

Unknown address error 557-'Your IP address (74.128.0.75) is from a blacklisted country.

 

Spam Filter logfile:

4/17/08 09:32:22:140 -- (396) Connection from: 74.128.0.75  -  Originating country : South Africa

 

WhoIs:

NetRange:   74.128.0.0 - 74.143.255.255
CIDR:       74.128.0.0/12
NetName:    INSIGHT-COMMUNCATIONS-CORP

 

Iana reports:

074/8   ARIN       2005-06   whois.arin.net      ALLOCATED

 

So the IP is part of Arin but Spam Filter is logging it as South Africa.  In the log file I also noticed:

 

04/17/08 09:32:22:140 -- (1424) Connection from: 90.188.164.173  -  Originating country : South Africa

 

A whois lookup on that IP goes to RIPE which lists it to Russia

:

inetnum:         90.188.144.0 - 90.188.191.255
netname:         WEBSTREAM
descr:           OJSC "Sibirtelecom"
remarks:         Omsk branch
remarks:         broadband service
country:         RU

How does SF determine what country an IP belongs to.  Is this something I can fix or will I have to quit using country filters.

 

I just recently downgraded from 4.0.0.772 to what I mentioned earlier.  The reason for the downgrade is because of an issue I started in another thread.  I will get back to that issue soon but I need to figure out what is happening here first.

MarkR,

Dan is correct, you may be using an old copy of the GeoIP country database. You may also download the updated file form our website at www.logsat.com/spamfilter/pub/geoip.zip. To use, just replace the current GeoIP.dat file in SpamFilter's directory with the one in the zip. While the update can be performed even if SpamFilter is running, if possible we'd recommend stopping SpamFilter first.