I have run into a wall trying to understand what's happening with my AWL stats -- If someone could point me to what else I should look at, I'd really appreciate it......
Using SA 3.0.2, redhat linux check_whitelist shows my email address like this: -5.4 (-350.5/65) -- [EMAIL PROTECTED]|ip=142.55 ------ Well, a spam got thru and AWL showed up in the list of rules that hit, and upon investigation, it appears that the above -5.4 adjustment was used in the computation of the score resulting in passing the message. Excerpts from the headers are: Return-path: [EMAIL PROTECTED] : Received: ... crucify.ytrikur.cl ([142.55.146.242] helo=mail.uccfootmen.org) From: Francisco Andrews <[EMAIL PROTECTED]> So .. in short, a forgery from 'me' to 'me', and SA seems to think the IP is 142.55... check_whitelist, however, shows a count of 65 occurrences. I've gone back & scanned ALL mail I've received since I put up 3.0.2, and there are no other occurrences of 142.55 besides the one that sneaked in... As I understand, '[EMAIL PROTECTED]|ip=142.55' is supposed to be unique to emails originating from 142.55.x.x, yet it shows 65 occurrences, and an (apparently) incorrect score of -5.4. Please, oh please.... what am I missing here? Thanks!
