Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - honeypot autofilter
  FAQ FAQ  Forum Search   Register Register  Login Login

honeypot autofilter

 Post Reply Post Reply
Author
dcook View Drop Down
Senior Member
Senior Member
Avatar

Joined: 31 January 2005
Location: United States
Status: Offline
Points: 174
Post Options Post Options   Thanks (0) Thanks(0)   Quote dcook Quote  Post ReplyReply Direct Link To This Post Topic: honeypot autofilter
    Posted: 12 June 2008 at 10:02am
I am having problems with some emails from sbcglobal.net that actually come from yahoo.com an sbc/att company.  The email sends a ndr and shows up in the log as

- IP blocked by honeypot autofilter -

What setting affect this?  I have whitelisted particular email addresses but the IP for the honeypot autofilter blocks anyway?  I have looked for documentation but can't find it.  Can anyone explain this filter to me or point me to a resource?  Thanks
 
DC
 


Edited by dcook - 12 June 2008 at 11:08am
Dwight
www.vividmix.com
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4068
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 12 June 2008 at 12:56pm
Dwight,

Sometimes emails will have a "From:" header with one address, but will have the "true" return address as something different. This "true" address is specified in the MAIL FROM command, and will usually appear in the "Return-Path" header. SpamFilter will act on the "true" address, not on the one specified in the "From:" header. If you whitelist this "true" address the this will indeed bypass all the other filters.

The "IP blocked by honeypot autofilter" is a bit tricky. This indicates that the email was blocked because the remote IP address has been used in the past to send *another* email addressed to an email address in your honeypot email list.

To find out exactly why that IP is being blocked you would have to scan thru all your logs to see when it was added to the IP honeypot list. This event will be logged as:

Added aaa.bbb.ccc.ddd to honeypot blacklist

Once you find that line, you will be able to see what email address the email was sent to (that email address was then at one point added by you as a "honeypot" to catch spammers).
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.047 seconds.