GFI
English Deutsch Français Italiano Nederlands Español
Forums  Register  Login  My Profile  Inbox  Address Book  My Subscription  My Forums 

Member List  Search  FAQ  Ticket List  Log Out

 

anti-phishing updates come from new server

  		Logged in as: Guest
Users viewing this topic: none
  Printable Version
All Forums >> [Content Security] >> GFI MailEssentials for Exchange/SMTP >> anti-phishing updates come from new server Page: [1]
Login
Message << Older Topic   Newer Topic >>
anti-phishing updates come from new server - 2.Oct.2008 10:14:19 AM   
joestern

 

Posts: 236
Joined: 18.Sep.2003
From: Philadelphia, PA
Status: offline 		We were getting lots of failed antiphishing update notifications and found that our ME14 server was reaching out to a previously unknown server called server4.gfi.com (216.218.202.30). I had to add this server to our firewall rules.

update.gfi.com resolves to, among other IP addresses, 216.218.211.34. A reverse lookup on that IP address shows server2.gfi.com. I assume that server4 got left off a DNS update somewhere.
Post #: 1
RE: anti-phishing updates come from new server - 2.Oct.2008 5:04:36 PM   
RobertSeattle

 

Posts: 53
Joined: 26.Jan.2007
Status: offline 		I recall seeing several SpamRazer update error messages over the past couple days as well.

(in reply to joestern)
Post #: 2
RE: anti-phishing updates come from new server - 3.Oct.2008 9:29:10 AM   
andrewm

 

Posts: 28
Joined: 13.Oct.2004
Status: offline
quote:

ORIGINAL: RobertSeattle

I recall seeing several SpamRazer update error messages over the past couple days as well.


SpamRazer updates come from *.mailshell.com and *.mailshell.net.  Of course this isn't documented anywhere.

Also, anti-phising updates are failing in my rule - which allows unauthenticated connections to update.gfi.com, update.gfisoftware.com and support.gfi.com (per KBID002184). 

I am now failing updates because it tries to connect to server3 and server4.gfi.com (or at least that's how ISA resolves it - never a problem in the past before this week).  I've added *.gfi.com, but really - this behavior should be consistent.  Information regarding which domains are needed for SpamRazer updates is completely missing from the previously referenced KB AND the SpamRazer updates part of the ME 14 manual.

(in reply to RobertSeattle)
Post #: 3
RE: anti-phishing updates come from new server - 3.Oct.2008 10:31:09 AM   
RSP

 

Posts: 450
Joined: 31.Oct.2006
From: UK
Status: offline 		For info:
server1.gfi.com [69.20.55.137]
server2.gfi.com [216.218.211.33]
server3.gfi.com [66.98.238.102]
server4.gfi.com [216.218.202.31]
server5.gfi.com [69.20.55.136]
server6.gfi.com [69.20.55.132]
server7.gfi.com [66.220.30.30]
server8.gfi.com [69.20.55.133]
server9.gfi.com [66.98.238.16]
server10.gfi.com [66.98.238.11]
server11.gfi.com [64.62.172.241
server12.gfi.com [72.32.64.164]
server13.gfi.com [72.32.64.165]
server14.gfi.com [72.32.64.166]
server15.gfi.com [69.20.55.134]
server16.gfi.com [72.32.64.167]
server17.gfi.com [72.32.64.171]
server18.gfi.com [72.32.64.170]
server19.gfi.com [72.32.64.168]
server20.gfi.com [72.32.64.169]
server21.gfi.com [69.20.55.140]
server22.gfi.com [69.20.55.139]

Servers on the 72.32.x.x range don't appear to have PTR entires - could this be a factor?

(in reply to andrewm)
Post #: 4
Page:   [1]
All Forums >> [Content Security] >> GFI MailEssentials for Exchange/SMTP >> anti-phishing updates come from new server Page: [1]
Jump to:





New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts


   © 2008. All rights reserved. GFI Software Home Products Download Trials Support Ordering Site Map About Us Contact us
GFI solutions: Exchange anti spam filter - exchange anti virus - isa server - network vulnerability scanner - event log management - USB security software - exchange archiving - fax server software