Hmm, nope, but I have also seen broken headers like you provided, but never with so much misplaced stuff in the header; from what Scott has previously mentioned, I would guess that the way your sample message is broken is that somewhere in the hops a mailserver put in an extraneous CR/LF.
The usual broken message I see has a complete and well-formed header, but no body at all. These messages are always sent from dsl/cable connections that are open relays, never a mail server. Perhaps Kami has seen this behaviour; I think it was he that suggested the BODY ISBLANK filter test. Andrew 8) -----Original Message----- From: John Tolmachoff (Lists) [mailto:[EMAIL PROTECTED] Sent: Thursday, November 27, 2003 11:14 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Subject and body is B > On a related note, I see rushes where the spam has no body and the same > header appears from multiple open relays all at the same time; I think > it's > broken spamware. You mean like this: (That is the entire D file.) ----------------------------------------------------------------------- Received: from DAYTON [24.117.148.25] by mail.domain.net with ESMTP (SMTPD32-8.04) id A9B350E0146; Thu, 27 Nov 2003 00:20:51 -0500 <html><title>I will not defame New Orleans --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
