Just to show an example: The header follows-
Yes- there are other tests that catch it. But from what I have seen so
far, the tests that have caught this e-Mail are not known to be 100%
proof of SPAM. I have seen these tests fail in some legitimate e-Mail.
The multiple UserID address test could have been a definite nail on this
item because other than [EMAIL PROTECTED] none of those are me!
------------------------------------
.
.
.
To: <[EMAIL PROTECTED]>
Cc: <[EMAIL PROTECTED]>, <[EMAIL PROTECTED]>, <[EMAIL PROTECTED]>,
<[EMAIL PROTECTED]>, <[EMAIL PROTECTED]>, <[EMAIL PROTECTED]>,
<[EMAIL PROTECTED]>, <[EMAIL PROTECTED]>, <[EMAIL PROTECTED]>,
<[EMAIL PROTECTED]>, <[EMAIL PROTECTED]>, <[EMAIL PROTECTED]>,
<[EMAIL PROTECTED]>, <[EMAIL PROTECTED]>, <[EMAIL PROTECTED]>,
<[EMAIL PROTECTED]>
From: [EMAIL PROTECTED]
Subject: [SPAM]EXPERT Consultants Available 2510
Date: Wed, 10 Jul 2002 11:35:31 -0400
MIME-Version: 1.0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Priority: 3
X-MSMail-Priority: Normal
Reply-To: [EMAIL PROTECTED]
X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail
client [c004400e].
X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam
[c004400e].
X-RBL-Warning: HEUR10: Heuristic spam detection level 10 [1.000000]
X-Declude-Sender: [EMAIL PROTECTED] [207.115.63.103]
X-Declude-Spoolname: D544802ed01b8bc24.SMD
X-Note: This E-mail was scanned by Declude (www.declude.com) for spam &
virus.
X-Spam-Tests-Failed: BADHEADERS, SPAMHEADERS, WEIGHT15, HEUR10
x-Weight: 19
X-Note: This E-mail was sent from pimout4-ext.prodigy.net.
([207.115.63.103]).
X-RCPT-TO: <[EMAIL PROTECTED]>
Status: U
X-UIDL: 326073932
--------------------------------------------
Hope the header helps.
Kami
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
Sent: Monday, July 15, 2002 1:53 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Watching CC's?
>While this is all true, I still agree that the test would be beneficial
>as something that could add weight.
Checking 10 of the E-mails at our spamtrap, several had multiple
Cc:'s. There was one that had 4 usernames that were the same, with
about 6
others that were similar. That E-mail also failed 16 spam tests, so
adding
a "multiple usernames" test wouldn't have really helped with any of
those
10 E-mails.
Are people here seeing lots of spam being sent this way -- the exact
same
username appearing multiple times in a Cc: header -- that isn't getting
caught otherwise?
-Scott
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". You can E-mail
[EMAIL PROTECTED] for assistance. You can visit our web
site at http://www.declude.com .
