Print Page | Close Window

honeypot autofilter

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6497
Printed Date: 13 January 2025 at 12:33pm


Topic: honeypot autofilter
Posted By: dcook
Subject: honeypot autofilter
Date Posted: 12 June 2008 at 10:02am
I am having problems with some emails from sbcglobal.net that actually come from yahoo.com an sbc/att company.  The email sends a ndr and shows up in the log as

- IP blocked by honeypot autofilter -

What setting affect this?  I have whitelisted particular email addresses but the IP for the honeypot autofilter blocks anyway?  I have looked for documentation but can't find it.  Can anyone explain this filter to me or point me to a resource?  Thanks
 
DC
 


-------------
Dwight
www.vividmix.com


Replies:
Posted By: LogSat
Date Posted: 12 June 2008 at 12:56pm
Dwight,

Sometimes emails will have a "From:" header with one address, but will have the "true" return address as something different. This "true" address is specified in the MAIL FROM command, and will usually appear in the "Return-Path" header. SpamFilter will act on the "true" address, not on the one specified in the "From:" header. If you whitelist this "true" address the this will indeed bypass all the other filters.

The "IP blocked by honeypot autofilter" is a bit tricky. This indicates that the email was blocked because the remote IP address has been used in the past to send *another* email addressed to an email address in your honeypot email list.

To find out exactly why that IP is being blocked you would have to scan thru all your logs to see when it was added to the IP honeypot list. This event will be logged as:

Added aaa.bbb.ccc.ddd to honeypot blacklist

Once you find that line, you will be able to see what email address the email was sent to (that email address was then at one point added by you as a "honeypot" to catch spammers).


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Print Page | Close Window