> Hmm, relating to this, my idea is, it could be, that spamassassin > tried to connect to cloudmark.com. I did not discover cloudmark.com > in the web somehow. So it might be no attack at all. I think, I will > pay attention at all, but forget about this case. That's almost certainly razor, running as a SA plugin. Mike.