procmail
[Top] [All Lists]

Re: anybody see this spam?

1997-05-07 11:10:00
(originally replied off list - but there is a pre-approval process in place
before messages are accepted there.  Geez.)

At 12:42 PM 5/7/97 -0400, Robert Nicholson wrote thusly:
This is the first intelligent SPAM that's broken through my defenses.
Mailer because I have a rule to catch all rules from a MAILER_DAEMON

Comments on the From: header?

[snip]

From: Mailer-Daemon

Well, I _believe_ that FROM_DAEMON may be expecting an @ symbol appearing
after the daemon name here (I can't recall ever seeing a daemon message
without an actual address here).

Also this header appears in the middle of the received stream (which makes
me rather suspicious of the received lines appearing after it (possibly
forged), though I don't know if there is anything in RFC822 that prohibits
this ordering).

X-Uidl: 9876543fgt9821376nb0988mm632xx321

As a rule, EVERY message I've ever receieved with an X-UIDL header has been
spam.  The presence of this header appears to cause odd actions with the
two big PC-Windows mailers (Eudora Pro and Pegasus).  I've had my
suspicions that it is planted in the header for exactly that reason - is
anyone interested in elaborating on this optional header?

<Prev in Thread] Current Thread [Next in Thread>