Filtered by "router" virtual_user_filter HUH? Where to start looking?

[eugenevdm.host]

In Mail Delivery Reports, I'm trying to track where on earth the "filtered" is coming from as laid out in the table at the bottom of this post. I've looked in the following places as no luck as yet:

Using the UI:

• Global Email Filters
• Email Filters
• Spam Filters

Using SSH:

`/etc/vfilters/domain.tld
/home/username/.cpanel/filter.yaml
/home/username/.filter`

The most common google search on this was resolved by "recreating hosting and email accounts". I'm not willing to do that! This user has had this account for over 5 years, and the hosting account has 100s of other emails.

Report:

Event:	filtered
Sender User:	-remote-
Sender Domain:
From Address:	[email protected]
Sender:
Sent Time:	Dec 9, 2019, 4:46:16 PM
Sender Host:	mailer148.gate85.rs.smtp.com
Sender IP:	74.91.85.148
Authentication:	localdelivery
Spam Score:	4.9
Recipient:	[email protected]
Delivered To:	/dev/null
Delivery User:	REDACTED_HOSTING_USER
Delivery Domain:	REDACTED.RECEIVER.DOMAIN
Router:	virtual_user_filter
Transport:	bypassed
Out Time:	Dec 9, 2019, 4:46:16 PM
ID:	1ieKJB-0003Az-JB
Delivery Host:	localhost
Delivery IP:	127.0.0.1
Size:	81.29 KB
Result:	Filtered

 

[cPanelLauren]

Hello,

My assumption is this is a user-level filter when a global filter is used it will output "central filter", though it will not log the specific filter.

Within cPanel you can find the user level filters at cPanel>>Email>>Email Filters

From the CLI you can find them at /home/$user/etc/$domain.tld/$emailuser/filter