There is no end to what is messed up with that message, mismatched hostnames
and ip addresses, but big problem is that rule.
Still, do like first posted said 'don't post the message here. Post the
whole message, headers and all on a web site and post a url to that message'

Posting the whole message wraps some headers and lines, messes up the AWL
averages for SA username, and might get blocked in some strict installations
due to content.

But, uribl_sc_swinog is not a standard sa rule.

Disable it if you don't know what it is or why it triggered.

Might as well use blacklist: blocked.secnap.net (google for it before you
implement, but it will block all spam if you score it high enough, or use in

My point is, don't use blacklists that you don't know anything about.

Michael Scheidell, CTO
>|SECNAP Network Security

Winner 2008 Network Products Guide Hot Companies
FreeBSD SpamAssassin Ports maintainer

__________________________________________________ _______________________
This email has been scanned and certified safe by SpammerTrap(r).
For Information please see http://www.spammertrap.com
__________________________________________________ _______________________