Sobig.x lies about its from email address so I have it setup as silent. But what I would like is if it email me a warning to the postmaster account ONLY if the source IP is in one the IP pools I own. This way I can look in my PPP logs, see who had that IP at that time and drop them an email or call. Matt