Someone asked about MIME:Lite the other day, but I just saw a Half.com member ad sent using that mailer yesterday.
Some of the ones in your list might not exist at all as a real mailer, "high life mail" for instance seems suspicious.
I've seen some other header segments that are clear hits for particular spammers that I filter on, but I've yet to notice an X-Mailer that Declude is capable of filtering on unless you want to get into version or format forging, and those patterns are likely very short lived.
Matt
Dave Doherty wrote:
Hi, everyone:
I would like to hear from anybody who has experience with filtering by the X-Mailer header. In going through my logs, the following look like they are consistently used for spam.
x-mailer: the bat! x-mailer: batmail x-mailer: ximian x-mailer: foxmail x-mailer: high life mail x-mailer: 3.1.76-xp/ng x-mailer: mime-tools x-mailer: quicksender x-mailer: thor x-mailer: incredimail x-mailer: mpop x-mailer: kmail x-mailer: quickmail x-mailer: direct mail x-mailer: mutt x-mailer: accucast x-mailer: becky! x-mailer: binderyfarce x-mailer: squirrelmail
Has anyone seen any of these used for legitimate mail? Any suggestions as to others you've seen on your system?
-Dave Doherty Skywaves, Inc.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
-- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =====================================================
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
