Ok, subject doesn't say much, but here is the deal. IMGate always checks the *last* sender IP address and looks up in the spam databases if it listed or not. Now, Check this header out (below), As you can see, 207.202.32.34 seems to be the spammer right?,not at all. IMGate is checking the spam databases if 207.202.32.34 is listed in any of them, negative, it's clean. However,the real spammer relies behind 63.143.236.242. And it is listed in every spam database I know of. Then the question is, why does IMGate check only the last sender IP address in the header? not the first one, where the email is originating from,? where the real spammer is hiding behind. That would definitely increase the accuracy. Any idea if we could do that ? Thanks. Serhan.
Received: from mail3.mezun.com [216.133.67.21] by mail.mezun.com with ESMTP (SMTPD32-7.07) id A036D2F0034; Thu, 03 Apr 2003 00:01:42 -0500 Received: from falafel.corp.idt.net (falafel.corp.idt.net [207.202.32.34]) by mail3.mezun.com (Postfix) with ESMTP id 31CF117AD for <[EMAIL PROTECTED]>; Thu, 3 Apr 2003 00:05:37 -0500 (EST) Received: from gateway2.att.net (63-143-236-242-grandmarc.vhc.winstar.com [63.143.236.242]) by falafel.corp.idt.net (8.11.6p2/8.11.6) with ESMTP id h3355J501129; Thu, 3 Apr 2003 00:05:19 -0500 (EST) Message-Id: <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> From: "Annie" <[EMAIL PROTECTED]> Subject: 5 For The Price Of 1 Magazine Subscription Sale (Coupon Code #300) Date: Thu, 03 Apr 2003 00:05:30 -0500 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_NextPart_000_59A1_00006450.000032D0" X-RCPT-TO: <[EMAIL PROTECTED]> Status: U X-UIDL: 312340700
