R. Scott Perry wrote:
What is the IP that Declude JunkMail is seeing here?
That last Received: header is indeed very poorly designed, where it would be quite difficult to determine automatically which IP was which.
I'm scanning on up to 4 hops and I assume that Declude can read everything besides the following line:
Received: from source ([66.109.19.198]) by exprod5mx118.postini.com ([12.158.34.245]) with SMTP;
This is the true source [66.109.19.198] and it happens to be blacklisted in my own DNSBL, SBL, AHBL and currently SPAMCOP, and all of those tests are configured to do lookups on up to 4 hops (HOPHIGH 3). Every one of the messages that came through Postini (psmtp.com) to pyramid.net and then to me failed to hit on any DNSBL. All the examples that I noted were static spam sources so there was only that one hop before all the gatewaying/forwarding between clean servers and that hop was identified on that line. In other words, that hop not getting tested was not unique to just this one message and they all look very much the same.
Thanks,
Matt
-- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =====================================================
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
