Thanks to all for the tips which pointed me (for some reason) to the Content_filter template at the site level, so this should block the [log in to unmask] postings.... >>> CONTENT_FILTER From: &[log in to unmask] Action: DISCARD Toss this message out John On Mon, 1 Nov 2004 [log in to unmask] wrote: > On Mon, 01 Nov 2004 13:17:10 EST, John Ryder said: > > Sure.....here are all the header lines... > > > Received: from LIST.UVM.EDU by LIST.UVM.EDU (LISTSERV-TCP/IP release 1.8e) with > > spool id 450812 for [log in to unmask]; Fri, 29 Oct 2004 14:55:28 -0400 > > OK.. this one *did* get touched by Listserv, at least we're trying to fight > the *right* problem. (We've had more than one case where spammer software > happened to create a case that *looked* like Listserv mail - often, they > just stick the first address on their list in both the From: and To:, and > then pile a bunch of RCPT TO: around it. Further evidence for this is the > 'Ashlyn J. Nadeau' on the From: line... >