OK.. I'm stumped.

User got this mail from Listserv:

> From: "LISTSERV.VT.EDU LISTSERV Server (16.0)" <[log in to unmask]>
> Subject: ODK: error report from UPDATEDBLOODSUGARINFO.US
> Date: July 7, 2014 3:46:52 PM EDT
> To: Laura Wedin <[log in to unmask]>
>
> The enclosed message, found in the ODK  mailbox and shown under the spool ID
> 93592523 in the system log, has been identified as a possible delivery error
> notice for the following reason: mail origin is listed in the "Filter=" list
> header keyword (or its default value for the ODK list).
>
> From: "Restore BloodSugar" <[log in to unmask]>
> Subject: Article: The-Secret to Normalize-Your Blood-Sugar

Weird.

The list doesn't have a Filter= in the list definition.  And my go.user has:

FILTER_ALSO='*@returnedaddress.com *@163.com *@163.net *@263.com *@263.net *@sina.com *@guest.com *@test.com *@test2.com *@etang.com *@21cn.con *@domain.com *@shjinglian.com *@167.com *@demo.com *@artauction.net *@artauction.com *@artmarket.com *@sohu.com *@tom.com *@sina.ca *@elong.com [log in to unmask]
FILTER_ALLOW="[log in to unmask]"

Thought it might be matching on Return-Path:, but....

Jul  7 15:46:52 listserv sendmail[21052]: s67JkpvR021052: from=<[log in to unmask]>, size=2138, class=0, nrcpts=1, msgid=<[log in to unmask]>, bodytype=7BIT, proto=ESMTP, daemon=MTA, relay=mr6.cc.ipv6.vt.edu [IPv6:2001:468:c80:2105:0:250:3bcb:5b17]

so that wasn't it either.  We saw a small flood from this address,but Listserv
didn't log a message it was flagged as a spam-source address either, so *that*
can't be why it got filtered.

Even snarfed the default string out of the 'lsv' binary with strings/grep, and
*that* didn't find anything that matched.

So where did it get the regexp that matched the source address?

############################

To unsubscribe from the LSTSRV-L list:
write to: mailto:[log in to unmask]
or click the following link:
http://peach.ease.lsoft.com/scripts/wa-PEACH.exe?SUBED1=LSTSRV-L&A=1