Yes, the BODY ISBLANK has done well for me. John Tolmachoff Engineer/Consultant/Owner eServices For You
> -----Original Message----- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Colbeck, Andrew > Sent: Thursday, November 27, 2003 12:11 PM > To: '[EMAIL PROTECTED]' > Subject: RE: [Declude.JunkMail] Subject and body is B > > Hmm, nope, but I have also seen broken headers like you provided, but > never > with so much misplaced stuff in the header; from what Scott has previously > mentioned, I would guess that the way your sample message is broken is > that > somewhere in the hops a mailserver put in an extraneous CR/LF. > > The usual broken message I see has a complete and well-formed header, but > no > body at all. These messages are always sent from dsl/cable connections > that > are open relays, never a mail server. Perhaps Kami has seen this > behaviour; > I think it was he that suggested the BODY ISBLANK filter test. > > Andrew 8) > > -----Original Message----- > From: John Tolmachoff (Lists) [mailto:[EMAIL PROTECTED] > Sent: Thursday, November 27, 2003 11:14 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Subject and body is B > > > > On a related note, I see rushes where the spam has no body and the same > > header appears from multiple open relays all at the same time; I think > > it's > > broken spamware. > > You mean like this: (That is the entire D file.) > ----------------------------------------------------------------------- > Received: from DAYTON [24.117.148.25] by mail.domain.net with ESMTP > (SMTPD32-8.04) id A9B350E0146; Thu, 27 Nov 2003 00:20:51 -0500 > <html><title>I will not defame New Orleans > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
