Subject: [Asrg] Re: Country numbers

From: [email-masked]
Date: Fri, 09 Dec 2005 13:36:46 -0600

> ( But "1" is no ISO 3166 country number, or is it ? )

I think that "1" is the country number for the USA!  (It's certainly the country 
number used for the USA in international phone calling, aren't those numbers the 
same?)

Gordon Peterson                  http://personal.terabites.com/
1977-2002  Twenty-fifth anniversary year of Local Area Networking!
Support free and fair US elections!  http://stickers.defend-democracy.org
12/19/98: Partisan Republicans scornfully ignore the voters they "represent".
12/09/00: the date the Republican Party took down democracy in America.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: John Levine <[email-masked]>
Date: 9 Dec 2005 21:24:44 -0000

>> ( But "1" is no ISO 3166 country number, or is it ? )

It's not.  ISO 3166 assigns each country or country-like territory a
two letter code (most familiarly used in ccTLDs), a three letter code,
and a three digit numeric code.  I don't know of anyone who uses the
numeric codes.  For example, the code for the U.S. is 840 and for
Canada is 124.

>I think that "1" is the country number for the USA!  (It's certainly
>the country number used for the USA in international phone calling,
>aren't those numbers the same?)

Nope.  You're thinking of ITU E.164 dialing codes, where "1" is for
the North American integrated numbering plan, which includes the US,
Canada, and a bunch of small islands.

By the way, what does any of this have to do with spam?

R's,
John

---

From: Ken Raeburn <[email-masked]>
Date: Fri, 9 Dec 2005 16:24:54 -0500

> number used for the USA in international phone calling, aren't  

If http://userpage.chemie.fu-berlin.de/diverse/doc/ISO_3166.html is  
accurate, the USA number is 840, and all the country codes are three  
digits.  (Other references, including at iso.org, also indicate that  
the ISO 3166 numeric codes are all three digits.)  A few start with  
"00" but "001" isn't in the list, though "100" is Bulgaria.

As for numbers used for international dialing, I'd gotten the  
(possibly mistaken?) impression somewhere that "00" and "011" are  
pretty common.  It would be pretty weird for every country to have a  
different way of doing international dialing.  (I'm sure there are  
multiple, but to making an effort to make it per-country would just  
be so wrong.)  Also, the international-dialing codes *for* different  
countries vary in length; the USA is "1", others are up to five  
digits according to http://kropla.com/dialcode.htm, though some of  
the longer ones appear to be subsets of others (e.g., "1" for US/ 
Canada/etc followed by an area code for some interesting entity that  
got listed, or "881" for Global Mobile Satellite System followed by  
one or two more digits for a specific system, etc).

Ken

---

From: Frank Ellermann <[email-masked]>
Date: Fri, 09 Dec 2005 22:31:10 +0100

[email-masked] wrote:
 
> I think that "1" is the country number for the USA!  (It's
> certainly the country number used for the USA in
> international phone calling, aren't those numbers the same?)

Not the same, the US number 840 is listed on their info page:

<http://countries.nerd.dk/more.html>  Apparently 127.0.0.8 is
their smallest result:  <http://countries.nerd.dk/isolist.txt>

                        Bye, Frank

---

From: "william(at)elan.net" <[email-masked]>
Date: Fri, 9 Dec 2005 13:57:36 -0800 (PST)

> their smallest result:  <http://countries.nerd.dk/isolist.txt>

I found ISO country code numbers to not be very interesting, nor are
they well known (some don't know it exists, otherwise confuse it with 
telephone codes, etc). For this and similar reasons I chose to use ASCII 
codes of ISO (IANA CCtld really) 2-letter codes for similar service:
  http://www.completewhois.com/statistics/data/ips-bycountry/rirstats/1ST-READ-THIS.txt

-- 
William Leibzon
Elan Networks
[email-masked]

---

From: Frank Ellermann <[email-masked]>
Date: Sat, 10 Dec 2005 02:08:48 +0100

> By the way, what does any of this have to do with spam?

Some users try to block IPs "by country", a horrible idea
for various reasons.  As unreliable "GEO IP" gimmick it's
nice, and William's scheme is better.

Originally it was about finding cases where result codes
127.0.0.0 and/or 127.0.0.1 are required for a BL.  Bye

---

From: "Walter Dnes" <[email-masked]>
Date: Sun, 11 Dec 2005 01:19:40 -0500

On Sat, Dec 10, 2005 at 02:08:48AM +0100, Frank Ellermann wrote
> for various reasons.

  Hey, I resemble that remark.  From my main blocking filter (I'm a
customer of clss.net)...

###########################
PIREJECTTAIL ar,br,cl,cn,fr,gb,gt,hk,in,id,il,it,jp,kr,my,nl,ng,pl,ro,ru,su,sg,es,za,tw,uk Certain countries (pireject-tail) If yours was a legitimate email see http://www.waltdnes.org/bypass.html to bypass block.
SIREJECTTAIL ar,br,cl,cn,fr,gb,gt,hk,in,id,il,it,jp,kr,my,nl,ng,pl,ro,ru,su,sg,es,za,tw,uk Certain countries (sireject-tail) If yours was a legitimate email see http://www.waltdnes.org/bypass.html to bypass block.

[...deletia...]

# 0.32 = Argentina; 0.76 = Brazil; 0.152 = Chile 0.156 = China; 0.250 = France;
# 1.88 = Hong Kong; 1.100 = India; 1.104 = Indonesia; 1.120 = Isreal;
# 1.124 Italy; 1.136 = Japan; 1.154 = Korea, South; 1.202 = Malaysia;
# 2.16 = Netherlands; 2.54 = Nigeria; 2.104 = Poland; 2.131 = Russia;
# 2.190 = Singapore; 2.198 = South Africa; 2.212 = Spain; 0.158 = Taiwan;
# 3.58 = United Kingdom
REJECT zz.countries.nerd.dk A 127.0.0.32,127.0.0.76,127.0.0.152,127.0.0.156,127.0.0.250,127.0.1.88,127.0.1.100,127.0.1.104,127.0.1.120,127.0.1.124,127.0.1.136,127.0.1.154,127.0.1.202,127.0.2.16,127.0.2.54,127.0.2.104,127.0.2.131,127.0.2.190,127.0.2.198,127.0.2.212,127.0.0.158,127.0.3.58 %TXT% (zz.countries.nerd.dk) If yours was a legitimate email see http://www.waltdnes.org/bypass.html to bypass block.
###########################

  Those seem to be the main sources of spam (aside from the US, which I
can't really block) aimed at me.  YMMV.  For the US, I block 4/8, 12/8,
24/8, and use various heuristics.  I put the DNSbls last in the checking.
This...
  a) Allows whitelist entries to do their thing
  b) Allows heuristics to check for rejection first.  This, in turn,...
     - Reduces IP traffic for the ISP
     - Reduces load on the DNSbls

  The beautiful part about variable-return DNSbls is that they allow me
to filter umpteen countries *WITH JUST ONE DNS LOOKUP*.

-- 
Walter Dnes <[email-masked]> In linux /sbin/init is Job #1
My musings on technology and security at http://tech_sec.blog.ca

---

From: Frank Ellermann <[email-masked]>
Date: Mon, 12 Dec 2005 01:16:07 +0100

Walter Dnes wrote:

> The beautiful part about variable-return DNSbls is that they
> allow me to filter umpteen countries *WITH JUST ONE DNS
> LOOKUP*.

If you know exactly what you're doing:  It would be strange
if you send mails (incl. potentially abusive mail or abuse
reports) to "them" while blocking their abuse reports or their
replies to your reports.

I'm in the "if you send mails to me, then you must also accept
abuse reports from me using essentially the same route" camp.

A Return-Path is a Return-Path is a Return-Path, as stated in
3934 and 821.  Maybe the "bounces-to" crowd would also agree
that sending MAIL FROM x to y while blocking mails from y to x
is utter dubious, but better ask them.

If you don't block mail to postmaster@ / abuse@ that point is
probably moot.  Another issue with blocking countries by IP is
of course the quality of the used list.  For some IP ranges it
is difficult to get this right.  217.0.0.0/8 is one case where
you might be in for surprises.
                              Bye, Frank

---

From: "Walter Dnes" <[email-masked]>
Date: Mon, 12 Dec 2005 01:00:23 -0500

On Mon, Dec 12, 2005 at 01:16:07AM +0100, Frank Ellermann wrote

> If you know exactly what you're doing:  It would be strange if you
> send mails (incl. potentially abusive mail or abuse reports) to "them"
> while blocking their abuse reports or their replies to your reports.

  This is specifically for places I don't have contacts in.  If I do, I
whitelist them.

> probably moot.

  I should've been more precise; that's just my waltdnes userid.  The
postmaster, abuse, and domain admin are not filtered at all, although
I'm very tempted with the domain admin address.  Problem is, that's
also my communications channel with my registrar, so I wouldn't want to
do anything there.  Well, maybe somebody HELO'ing as waltdnes.org.

> Another issue with blocking countries by IP is of course the quality
> of the used list.  For some IP ranges it is difficult to get this
> right.  217.0.0.0/8 is one case where you might be in for surprises.

  I remember the fun and games once it became obvious to the 419
shysters that Nigeria was being blocked to Hell and back.  They'd
register a /24 in the UK or elsewhere.  And they burned through a bunch
of satellite service CIDRss.  I reported several to the maintainer.  The
weird part was that despite going to all that trouble to hide in another
country's address space, thay'd actually put "NG" in the country field
of their allocation.

---

From: "Mark E. Mallett" <[email-masked]>
Date: Thu, 15 Dec 2005 13:01:30 -0500

>  http://www.completewhois.com/statistics/data/ips-bycountry/rirstats/1ST-READ-THIS.txt

Indeed.  FWIW, the countries.nerd.dk DNSBL also returns 2-character country
codes as a TXT reply (as specifically stated in the URL above).  I have
been using it in my own mailbox filter script to add an "X-Country-Code"
header -- so far just for exposition only, not to act on.

mm