Hi

I'm searching for who is tagging our mails with ***SPAM***

So, we use SF since years and we configured all the time without tagging, only block or quarantaine mails.
But now we get more and more mails with this tag and I don't know if it's SF who tags the mails in some circumstances.

Received: from mail.mydomain.com (172.17.36.2) by exchange.servername.ads
 (172.17.36.75) with Microsoft SMTP Server id 8.1.436.0; Thu, 20 May 2010
 11:59:12 +0200
Received: from 194.42.133.147 by mail.mydomain.com (LogSat Software SMTP
 Server); Thu, 20 May 2010 12:01:12 +0200
Received: from User ([91.208.165.7]) by mail2003.nestco.dom with Microsoft
 SMTPSVC(6.0.3790.3959);     Thu, 20 May 2010 12:44:03 +0300
Reply-To: <link.dearrestjerry@live.com>
From: "Mrs. Ruth Joseph" <mrs.ruthjoseph@mail.com>
Subject: *** SPAM ***YOUR OUTSTANDING PAYMENT NOTIFICATION
Date: Sat, 9 Mar 2002 01:38:49 +0330
MIME-Version: 1.0
Content-Type: text/html; charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 5
X-MSMail-Priority: Low
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
BCC:
Message-ID: <MAIL2003fMs5f0JBexD00007dac@mail2003.nestco.dom>
X-OriginalArrivalTime: 20 May 2010 09:44:04.0199 (UTC) FILETIME=[FBD1A770:01CAF800]
X-Server: LogSat Software SMTP Server
X-SF-RX-Return-Path: <mrs.ruthjoseph@mail.com>
X-SF-HELO-Domain: mail2003.nestco.dom
X-SF-Originating-IP: 194.42.133.147
Return-Path: mrs.ruthjoseph@mail.com
X-MS-Exchange-Organization-SCL: 8
X-Spam-Flag: YES
X-Spam-Status: YES, hits=8 required=5,
 ct-refid=[str=0001.0A3C0009.4BF507C9.003B,ss=3,pt=84572,fgs=0],
 tests=CTENGINE_CONFIRMED

I guess all tags from SF will look like "X-SF", right? So then this tag could not be from SF?

Thanx for the confirmation 
Wayne

yapadu wrote: The ones you have listed are from SpamAssassin, so at some point that message must have passed through a SpamAssassin server.  OR some spammer is adding them ;-)

Yeah, but we don't have a SpamAssassin server, only Provider -> Firewall -> Logsat Spamfilter -> Exchange 2007

Firewall I can exclude, Exchange I guess also, because I checked everything and all spamfilter features are disabled. That's why I suspicious SF

From the spammer himself it also can't be, because I get a Newsletter from a supplier with the same tag, so somebody here must have smuggle in a new spamfilter software without telling me

It is really strange

Argh, I suspected already, so my search continues

Thx Roberto