Ditto for me, not a single message ever caught by this test. Bill ----- Original Message ----- From: "Kami Razvan" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, November 27, 2003 1:14 PM Subject: RE: [Declude.JunkMail] Subject and body is B
> Hi; > > I suggested body blank but frankly it has never been hit. I think it is > because an email body is NEVER blank.. It always has some code.. > > I remember exchanging a blank email with Scott that was not detected with > ISBLANK and that was his comment. > > Perhaps the test is run by doing a Length count of characters in the body > and if they send a blank HTML email the body is never blank. > > Interesting that John has seen good result.. I don't remember seeing any.. > > Regards, > Kami > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff > (Lists) > Sent: Thursday, November 27, 2003 3:41 PM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Subject and body is B > > Yes, the BODY ISBLANK has done well for me. > > John Tolmachoff > Engineer/Consultant/Owner > eServices For You > > > > -----Original Message----- > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > > [EMAIL PROTECTED] On Behalf Of Colbeck, Andrew > > Sent: Thursday, November 27, 2003 12:11 PM > > To: '[EMAIL PROTECTED]' > > Subject: RE: [Declude.JunkMail] Subject and body is B > > > > Hmm, nope, but I have also seen broken headers like you provided, but > > never with so much misplaced stuff in the header; from what Scott has > > previously mentioned, I would guess that the way your sample message > > is broken is that somewhere in the hops a mailserver put in an > > extraneous CR/LF. > > > > The usual broken message I see has a complete and well-formed header, > > but no body at all. These messages are always sent from dsl/cable > > connections that are open relays, never a mail server. Perhaps Kami > > has seen this behaviour; I think it was he that suggested the BODY > > ISBLANK filter test. > > > > Andrew 8) > > > > -----Original Message----- > > From: John Tolmachoff (Lists) [mailto:[EMAIL PROTECTED] > > Sent: Thursday, November 27, 2003 11:14 AM > > To: [EMAIL PROTECTED] > > Subject: RE: [Declude.JunkMail] Subject and body is B > > > > > > > On a related note, I see rushes where the spam has no body and the > > > same header appears from multiple open relays all at the same time; > > > I think it's broken spamware. > > > > You mean like this: (That is the entire D file.) > > ---------------------------------------------------------------------- > > - > > Received: from DAYTON [24.117.148.25] by mail.domain.net with ESMTP > > (SMTPD32-8.04) id A9B350E0146; Thu, 27 Nov 2003 00:20:51 -0500 > > <html><title>I will not defame New Orleans > > --- > > [This E-mail was scanned for viruses by Declude Virus > > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > > "unsubscribe Declude.JunkMail". The archives can be found at > > http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, > just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe > Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
