Shouldn't the scoring reason before the disconnect say something about the penalty trap address instead of the suspicious HELO? It looks like ASSP lost track of the reason:
Feb-18-09 10:45:26 Connected: 78.108.248.241:3861 -> 192.168.0.5:25 -> 192.168.0.5:2525 Feb-18-09 10:45:28 ID-82728-01463 78.108.248.241 <[email protected]> MessageScore is now 10, after adding 10 (Suspicious HELO - contains IP: '[78.108.248.241]') Feb-18-09 10:45:28 ID-82728-01463 78.108.248.241 <[email protected]> IP-Score for '78.108.248.0' is now 410, after adding 10 (Suspicious HELO - contains IP: '[78.108.248.241]') Feb-18-09 10:45:28 ID-82728-01463 78.108.248.241 <[email protected]> [scoring] (Suspicious HELO - contains IP: '[78.108.248.241]') Feb-18-09 10:45:29 PB: trap address [email protected] found Feb-18-09 10:45:29 ID-82728-01463 [Trap] 78.108.248.241 <[email protected]> penalty trap address: [email protected] Feb-18-09 10:45:29 ID-82728-01463 78.108.248.241 <[email protected]> IP-Score for '78.108.248.0' is now 610, after adding 200 (Suspicious HELO - contains IP: '[78.108.248.241]') Feb-18-09 10:45:29 Disconnected: 78.108.248.241 ------------------------------------------------------------------------------ Open Source Business Conference (OSBC), March 24-25, 2009, San Francisco, CA -OSBC tackles the biggest issue in open source: Open Sourcing the Enterprise -Strategies to boost innovation and cut costs with open source participation -Receive a $600 discount off the registration fee with the source code: SFAD http://p.sf.net/sfu/XcvMzF8H _______________________________________________ Assp-test mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/assp-test
