OK. The reason that VIRUS emails still appear in the No-Blacklist spam reports, is that in the Order of Rules, the virus filter rules are superior to the User/Admin blacklisting rules. And as such are applied to an email before the User/Admin blacklisting rules. As shown below:


Filtering: Detailed rule set structure 


If the email does trigger the Virus rules? It is then quarantined before the User/Admin Blacklists can be applied. And as we still have a duty to report this to the user. So, the virus quarantined emails are still listed in the User/Admin spam report.



SOURCE REF: Hornet - FD 97569/97571 & 25112307


DATE: 6.2.19