>Do you have some example headers?
This is a legitimate email, but it got flagged as USER_IN_WHITELIST
while CNN is not listed in my whitelist:
Received: from cnnimail33.turner.com (cnnimail33.turner.com
[64.236.25.90])
by spamfilter.onlineky.net (Postfix) with ESMTP id 2FB331757E
for <[EMAIL PROTECTED]>; Fri, 12 Jan 2007 09:36:50 -0600
(CST)
Received: from mail.cnn.com (10.165.130.21)
by cnnimail33.turner.com with ESMTP; 12 Jan 2007 10:36:49 -0500
Message-Id: <[EMAIL PROTECTED]>
From: CNNMoney.com Alerts <[EMAIL PROTECTED]>
Reply-To: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject: Russia's Lukoil pumps $2.4B in profits
MIME-Version: 1.0
Content-Type: TEXT/HTML; charset=US-ASCII
Date: Fri, 12 Jan 2007 09:36:50 -0600 (CST)
This one is most likely spam as this email account has been inactive for
at least 6 months:
Received: from tigger.babycenter.com (tigger.babycenter.com
[10.128.130.152])
by cosby.mailsender.com (8.13.8/8.13.8) with ESMTP id
l0D5hne7011671
for <[EMAIL PROTECTED]>; Fri, 12 Jan 2007 21:44:03
-0800 (PST)
Message-ID:
<[EMAIL PROTECTED]>
Date: Fri, 12 Jan 2007 21:43:49 -0800 (PST)
From: BabyCenter Store <[EMAIL PROTECTED]>
Reply-To: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject: This weekend only. $50 off on top of sale prices.
Mime-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable
Another one to that same user:
Received: from MYWX-S8.myweather.net (cliff.myweather.net
[64.73.35.115])
by spamfilter.onlineky.net (Postfix) with ESMTP id 8ED2119631
for <[EMAIL PROTECTED]>; Sat, 13 Jan 2007 02:31:14
-0600 (CST)
Received: by MYWX-S8.myweather.net (PowerMTA(TM) v2.0r13) id
hl2cd6046443; Sat, 13 Jan 2007 02:31:01 -0600 (envelope-from
<[EMAIL PROTECTED]>)
Date: Sat, 13 Jan 2007 02:31:01 -0600
Subject: Your Personal Predictor
x-envid: 1168677003.1103304562
To: [EMAIL PROTECTED]
From: [EMAIL PROTECTED]
Content-type: text/html; charset="ISO-8859-1"
Message-Id: <[EMAIL PROTECTED]>
This one got flagged as spam for several other users and then got the
USER_IN_WHITELIST out of the blue:
Received: from mta130.e.drugstore.com (mta130.e.drugstore.com
[66.165.105.168])
by spamfilter.onlineky.net (Postfix) with SMTP id 9BCA41BFA6
for <[EMAIL PROTECTED]>; Sun, 14 Jan 2007 07:41:04 -0600 (CST)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=200505; d=e.drugstore.com;
b=cY8Vpx/rnCIRMKPGZRNHM4/KNsEpr4kHYii2STgI9W6HEF2b9Di5sIret/1YfAqwoGtfis
iuPTBVdqNgjuFdDrRKkSapc4KvdDIOMTJlusKwn4ViXq0Pp/hgoVBuJ5StpuOl4aJZGrRSte
srCsYmvwo1IaDqSRaqoOCVbTZq2lI=;
h=Date:Message-ID:List-Unsubscribe:From:To:Subject:MIME-Version:Reply-To
:Content-type;
Date: Sun, 14 Jan 2007 13:41:04 -0000
Message-ID:
<[EMAIL PROTECTED]>
List-Unsubscribe:
<mailto:[EMAIL PROTECTED]>
From: "drugstore.com" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: Save up to 40% and stock up for the new year
MIME-Version: 1.0
Reply-To: "drugstore.com"
<[EMAIL PROTECTED]>
Content-type: multipart/alternative;
boundary="=b19wt9ya08rqp8bx3mk4jbujgjpyka
Received: from nl-mail5.internet.com (nl-mail5.internet.com
[64.62.164.185])
by spamfilter.onlineky.net (Postfix) with ESMTP id CE73821EA0
for <[EMAIL PROTECTED]>; Tue, 16 Jan 2007 09:40:16 -0600
(CST)
Received: from nl.internet.com (192.168.5.118)
by nl-mail5.internet.com with ESMTP; 16 Jan 2007 07:39:02 -0800
Received: by mail8.internet.com (Postfix, from userid 0)
id EDFA41190032; Tue, 16 Jan 2007 07:38:56 -0800 (PST)
To: [EMAIL PROTECTED]
Subject: Tech Brief: Manage Performance & Availability of .NET Apps
Reply-To: [EMAIL PROTECTED]
Content-description: [EMAIL PROTECTED]
Content-Type: text/plain; charset="us-ascii"
From: "DevX Skill Building Update"
<[EMAIL PROTECTED]>
Message-Id: <[EMAIL PROTECTED]>
Date: Tue, 16 Jan 2007 07:38:56 -0800 (PST)
Received: from dc1img10.digitalriver.com (dc1img10.digitalriver.com
[66.192.69.11])
by spamfilter.onlineky.net (Postfix) with ESMTP id BC3021FEAC
for <[EMAIL PROTECTED]>; Tue, 16 Jan 2007 10:26:27 -0600
(CST)
Date: 16 Jan 2007 10:26:13 -0600
From: "Nuance - Makers of PaperPort" <[EMAIL PROTECTED]>
X-Complaints-to: [EMAIL PROTECTED]
To: "Nancy" <[EMAIL PROTECTED]>
Reply-To: "Nuance - Makers of PaperPort" <[EMAIL PROTECTED]>
Message-ID: <[EMAIL PROTECTED]>
Subject: Exclusive customer savings on OmniPage - 50% off
X-MID: 19198-bhb2fz7bz5vsedwr2
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="------------06986E0E1E196312E032AFBC"
--
Thanks,
James
--
CONFIDENTIALITY NOTICE: This e-mail message, including any attachments, is for
the sole use of the intended recipient(s) and may contain confidential and
privileged information. Any unauthorized review, use, disclosure or
distribution is prohibited. If you are not the intended recipient, please
contact the sender by reply e-mail and destroy all copies of the original
message.
--
This message has been scanned for viruses and dangerous content by MailScanner
and is believed to be clean.
