Hi Scott

Second the manual we can have up to 20 IPBYPASS entries.
At the moment I'm already over this limit:

IPBYPASS        194.242.192.2   # local providers
IPBYPASS        194.242.192.3  
IPBYPASS        194.242.196.14 
IPBYPASS        213.21.176.244 
IPBYPASS        213.21.176.246 
IPBYPASS        195.254.224.4   

IPBYPASS        193.70.192.33   # Virgilio
IPBYPASS        193.70.192.38   
IPBYPASS        193.70.192.46   
IPBYPASS        193.70.192.51   
IPBYPASS        193.70.192.52   
IPBYPASS        193.70.192.62   
IPBYPASS        193.70.192.127  

IPBYPASS        212.216.176.58  # Tin
IPBYPASS        212.216.176.185
IPBYPASS        212.216.176.187 
IPBYPASS        212.216.176.206 
IPBYPASS        212.216.176.221 
IPBYPASS        212.216.176.222 
IPBYPASS        212.216.176.223 
IPBYPASS        212.216.176.224

The first block are MTAs from other local ISPs where we have setup numerous mail 
forwardings. So we can search for open relays also on this forwarded messages.

The seconds and third block are groups of MTAs of two large italian ISPs. All this IPs 
are listed now for over 3 months in more or less IP blacklists.

The problem is, that we receive much more legit messages from this IPs as spam. 
(usually over 95% is legit). More then 75% of our FPs are FPs because they triggered 
this IP blacklist tests.

Until yesterday I've tried to counterweight this points with an IP filterlist that 
gives some negative points.

The problem is that numerous IP blacklist providers are adding and removing part of 
this IP ranges daily/weekly. So it's nearly impossible to define an accurate 
counterweight for the IP filter file. If I substract too much this will let pass more 
spam messages. Otherwise I will have much more FPs.

The problem can be solved by adding this IPs to thy IPBYPASS list, because so all this 
IPs are ignored and we can try to catch spams with the remaining tests.

Would it by possible to specify IPBYPASS-ranges or to use an external IP file?

Markus 
                 
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Reply via email to