[Rspamd-Users] Incorrect country code for IP (maybe a bug?)

[Albrecht Backhaus]

Am 06.03.2020 13:06:07, "Emanuel Gonzalez" 
<emanuel_gonzalez at live.com.ar> schrieb:

>Hello,
>
>In my server i use this map:
>
>COUNTRY_SPAMMER {
>         type = "country";
><------>map = "redis://countryspam";
>         description = "IP Bad country";
>     }
>
>2020-03-06 08:19:31 #3719(normal) <a9be14>; task; rspamd_task_write_log: id: <3Bl-de711d347e-A at embluemail.com>, qid: <1jAB0r-0007R8-95>, ip: 185.98.146.51
>, from: <emblue3prd_bm at emark13.embluejet.com>, (default: F (no action): [14.07/30.00] [FUZZY_DENIED(10.51){1:35d9fef3e7:1.00:txt;},SENDER_WHITELIST_HEADER
>_FROM(-5.00){dfe at comunicaciones.arba.gov.ar;},COUNTRY_SPAMMER(4.00){NL;},BAYES_SPAM(3.62){95.82%;},R_MIXED_CHARSET(0.54){},FORGED_SENDER(0.30){dfe at comunic
>aciones.arba.gov.ar;emblue3prd_bm at emark13.embluejet.com;},BAD_REP_POLICIES(0.10){},MIME_GOOD(-0.10){multipart/alternative;text/plain;},ONCE_RECEIVED(0.10)
>{},HAS_LIST_UNSUB(-0.01){},ARC_NA(0.00){},ASN(0.00){asn:51050, ipnet:185.98.144.0/22, country:NL;},DKIM_TRACE(0.00){comunicaciones.arba.gov.ar:+;embluenit
>ro.com:+;},DMARC_POLICY_ALLOW(0.00){comunicaciones.arba.gov.ar;none;},FROM_HAS_DN(0.00){},FROM_NEQ_ENVFROM(0.00){dfe at comunicaciones.arba.gov.ar;emblue3prd
>_bm at emark13.embluejet.com;},HAS_REPLYTO(0.00){dfe at comunicaciones.arba.gov.ar;},MIME_TRACE(0.00){0:+;1:+;2:~;},MX_GOOD(0.00){cached: emark13.embluejet.com;
>},RCPT_COUNT_ONE(0.00){1;},RCVD_COUNT_ONE(0.00){1;},RCVD_TLS_ALL(0.00){},REPLYTO_ADDR_EQ_FROM(0.00){},RM_HEADER_00(0.00){},RM_HEADER_03(0.00){},R_DKIM_ALL
>OW(0.00){comunicaciones.arba.gov.ar:s=epexo;embluenitro.com:s=epexo;},R_SPF_ALLOW(0.00){+ip4:185.98.146.1/24:c;},TO_DN_NONE(0.00){},TO_MATCH_ENVRCPT_ALL(0
>.00){}]), len: 9391, time: 1287.564ms, dns req: 35, digest: <670eac3bab9efdc1644bff59177f5f76>, rcpts: <gabriela at conserviajes.com.ar>, mime_rcpts: <gabrie
>la at conserviajes.com.ar>
>
>I see that there is an error in the country code of an IP address: 185.98.146.51
>
>inetnum:        185.98.146.0 - 185.98.146.255
>netname:        COLO-EMBLUE-DCG-3024
>org:            ORG-NNN1-RIPE
>descr:          emBlue
>country:        AR
>admin-c:        EEMP1-RIPE
>tech-c:         EEMP1-RIPE
>status:         ASSIGNED PA
>mnt-by:         MNT-H4HOSTING
>created:        2018-10-01T10:35:12Z
>last-modified:  2018-10-01T10:36:30Z
>source:         RIPE
>
>The correct country code is AR, but Rspamd does not recognize that ip is from Argentina.
>
>Maybe a bug?
>
>Regards,
>--
>Users mailing list
>Users at lists.rspamd.com
>https://lists.rspamd.com/mailman/listinfo/users

rspamd is correct -> look here https://dnslytics.com/ip/185.98.146.51