[Bug 5064] New: RCVD_IN_WHOIS_BOGONS FP on the sender's internal network

[bu...@bugzilla.spamassassin.org]

http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5064

           Summary: RCVD_IN_WHOIS_BOGONS  FP on the sender's internal
                    network
           Product: Spamassassin
           Version: 3.1.3
          Platform: Other
        OS/Version: other
            Status: NEW
          Severity: normal
          Priority: P5
         Component: Rules
        AssignedTo: dev@spamassassin.apache.org
        ReportedBy: nj@leverton.org


The RCVD_IN_WHOIS_BOGONS test is mis-firing on mail from mobistar.be, who use  
externally-invalid netblocks in their internal network (to be precise,  
175.175.74.19) but who deliver through a valid external MX.  
  
It seems to me that this rule and   
RCVD_IN_WHOIS_HIJACKED should use the -notfirsthop modifier, as   
RCVD_IN_WHOIS_INVALID already does. 
   
Do the corpora show any examples of spam originating from bogon/hijacked   
netspace but sending through a non-bogon IP address ?  If there are, those   
would be missed by such a change so it'd be a bad idea - but otherwise I think  
it makes sense.



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

[Bug 5064] RCVD_IN_WHOIS_BOGONS FP on the sender's internal network

[bu...@bugzilla.spamassassin.org]

http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5064





------- Additional Comments From nj@leverton.org  2006-08-24 13:41 -------
Created an attachment (id=3674)
 --> (http://issues.apache.org/SpamAssassin/attachment.cgi?id=3674&action=view)
Headers from example mail.




------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

[Bug 5064] RCVD_IN_WHOIS_BOGONS FP on the sender's internal network

[bu...@bugzilla.spamassassin.org]

http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5064





------- Additional Comments From nj@leverton.org  2006-08-24 13:53 -------
Minor correction: in 3.1.3 please read the foregoing as -lastexternal not 
-notfirsthop. 



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

[Bug 5064] RCVD_IN_WHOIS_BOGONS FP on the sender's internal network

[bu...@bugzilla.spamassassin.org]

http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5064





------- Additional Comments From jm@jmason.org  2007-02-09 06:47 -------
is this still an issue in the 3.2.0 snapshots?  looks like it might have fallen
through the cracks :(



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.