Yes, I see some reported spam with that "Content-Transfer-Encoding: plain" and no real mail in four months of my old mail. Looks good. I would test it myself but it's late the day before a three-day weekend (here in the States) so I do not want to make changes right now.
---
This reminds me that I found it worthwhile to check the MIME-Version header. It should of course look like this:
MIME-Version: 1.0
But there is a spam product that feels it needs to qualify that further. Look for /MIME-Version:.*\(produced by/ to find such as these:
MIME-Version: 1.0 (produced by septennialcongressmen 9.5) MIME-Version: 1.0 (produced by avereedbuck 4.5) MIME-Version: 1.0 (produced by crepepinto 3.7) MIME-Version: 1.0 (produced by cypriancrash 6.8) MIME-Version: 1.0 (produced by explicitblown 2.7) MIME-Version: 1.0 (produced by padlupine 0.7)<br> MIME-Version: 1.0 (produced by clinchcrosswalk 4.3) MIME-Version: 1.0 (produced by sacrilegioussailboat 7.1) MIME-Version: 1.0 (produced by airlinechomp 6.4) MIME-Version: 1.0 (produced by bustardchloroform 9.0) MIME-Version: 1.0 (produced by vocalicapprentice 6.3) MIME-Version: 1.0 (produced by diversebangladesh 7.2) MIME-Version: 1.0 (produced by aberrateaccelerate 8.1) MIME-Version: 1.0 (produced by allianceribonucleic 2.2)
It's the same spam product that inserts patternbusters with 1-pixel characters, e.g.
<p class=3D"MsoNormal" style=3D"margin-left: 8; margin-right: 8">Hel= lo de<FONT style=3D"FONT-SIZE: 1px">+</font>a<FONT style=3D"FONT-SIZE: = 1px">85</font>r home o<FONT style=3D"FONT-SIZE: 1px">)</font>wn<FONT style= =3D"FONT-SIZE: 1px">!</font>er,</p>
Painfully, that's "Hello, dear howeowner"!
Joseph Brennan Academic Technologies Group, Academic Information Systems (AcIS) Columbia University in the City of New York
_______________________________________________ Visit http://www.mimedefang.org and http://www.canit.ca MIMEDefang mailing list [EMAIL PROTECTED] http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
