Print Page | Close Window

Non Arin country filter blocking Arin address.

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6461
Printed Date: 22 December 2024 at 11:04am


Topic: Non Arin country filter blocking Arin address.
Posted By: MarkR
Subject: Non Arin country filter blocking Arin address.
Date Posted: 17 April 2008 at 4:23pm
Someone sending to us received the following error (we are using Spam Filter 3.5.4.730).
 
Unknown address error 557-'Your IP address (74.128.0.75) is from a blacklisted country.
 
Spam Filter logfile:
4/17/08 09:32:22:140 -- (396) Connection from: 74.128.0.75  -  Originating country : South Africa
 
WhoIs:
NetRange:   74.128.0.0 - 74.143.255.255
CIDR:       74.128.0.0/12
NetName:    INSIGHT-COMMUNCATIONS-CORP
 
Iana reports:
074/8   ARIN       2005-06   whois.arin.net      ALLOCATED
 
So the IP is part of Arin but Spam Filter is logging it as South Africa.  In the log file I also noticed:
 
04/17/08 09:32:22:140 -- (1424) Connection from: 90.188.164.173  -  Originating country : South Africa
 
A whois lookup on that IP goes to RIPE which lists it to Russia
:
inetnum:         90.188.144.0 - 90.188.191.255
netname:         WEBSTREAM
descr:           OJSC "Sibirtelecom"
remarks:         Omsk branch
remarks:         broadband service
country:         RU
How does SF determine what country an IP belongs to.  Is this something I can fix or will I have to quit using country filters.
 
I just recently downgraded from 4.0.0.772 to what I mentioned earlier.  The reason for the downgrade is because of an issue I started in another thread.  I will get back to that issue soon but I need to figure out what is happening here first.


Replies:
Posted By: Desperado
Date Posted: 17 April 2008 at 5:46pm
MarkR,
 
Try getting the very latest geo file from :
http://www.maxmind.com/download/geoip/database/GeoIP.dat.gz - http://www.maxmind.com/download/geoip/database/GeoIP.dat.gz
and replace the existing one in your SpamFilter folder


-------------
The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com

Posted By: LogSat
Date Posted: 17 April 2008 at 10:16pm
MarkR,

Dan is correct, you may be using an old copy of the GeoIP country database. You may also download the updated file form our website at www.logsat.com/spamfilter/pub/geoip.zip. To use, just replace the current GeoIP.dat file in SpamFilter's directory with the one in the zip. While the update can be performed even if SpamFilter is running, if possible we'd recommend stopping SpamFilter first.

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Print Page | Close Window