Winship wrote: >But SoBig doesn't spoof subscription email, does it? It just spoofs email >addresses, with its own message, which won't generate a subscribe >confirm message. Right? > Wrong... I'm getting hit by one machine on bellsouth.net that is sending subscribe messages every day from different e-mail addresses. I added the .dd &MAILHEADER to the ADDREQ1 template to make sure it was a real request. I also sent the message with complete headers to [log in to unmask] and got no response from them and it is still happening.... Glenn