Hi; I suggested body blank but frankly it has never been hit. I think it is because an email body is NEVER blank.. It always has some code..
I remember exchanging a blank email with Scott that was not detected with ISBLANK and that was his comment. Perhaps the test is run by doing a Length count of characters in the body and if they send a blank HTML email the body is never blank. Interesting that John has seen good result.. I don't remember seeing any.. Regards, Kami -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff (Lists) Sent: Thursday, November 27, 2003 3:41 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Subject and body is B Yes, the BODY ISBLANK has done well for me. John Tolmachoff Engineer/Consultant/Owner eServices For You > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Colbeck, Andrew > Sent: Thursday, November 27, 2003 12:11 PM > To: '[EMAIL PROTECTED]' > Subject: RE: [Declude.JunkMail] Subject and body is B > > Hmm, nope, but I have also seen broken headers like you provided, but > never with so much misplaced stuff in the header; from what Scott has > previously mentioned, I would guess that the way your sample message > is broken is that somewhere in the hops a mailserver put in an > extraneous CR/LF. > > The usual broken message I see has a complete and well-formed header, > but no body at all. These messages are always sent from dsl/cable > connections that are open relays, never a mail server. Perhaps Kami > has seen this behaviour; I think it was he that suggested the BODY > ISBLANK filter test. > > Andrew 8) > > -----Original Message----- > From: John Tolmachoff (Lists) [mailto:[EMAIL PROTECTED] > Sent: Thursday, November 27, 2003 11:14 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Subject and body is B > > > > On a related note, I see rushes where the spam has no body and the > > same header appears from multiple open relays all at the same time; > > I think it's broken spamware. > > You mean like this: (That is the entire D file.) > ---------------------------------------------------------------------- > - > Received: from DAYTON [24.117.148.25] by mail.domain.net with ESMTP > (SMTPD32-8.04) id A9B350E0146; Thu, 27 Nov 2003 00:20:51 -0500 > <html><title>I will not defame New Orleans > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > "unsubscribe Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
