On Tue, Feb 21, 2006 at 09:35:46AM -0600, Richard Laager wrote:
> This makes me thing... Are double From: headers a good indicator of
> spam?
I'd guess it is. Duplicate From: headers are illegal, according to
rfc 2822 (section 3.6.1). However, you can have multiple addresses in
one From: header.
A quick check finds 3 examples of this in my recent spam, and zero
in ham, but that's a real quick and limited check over like 1500
messages.
I wouldn't mind blocking email on sillyness like this. If there ever is
a legitimate site doing it, you can at least slap them with the RFC and
explain they were doing something REALLY bizarre.
--
#!perl -wpl # mmfppfmpmmpp mmpffm <[EMAIL PROTECTED]>
$p=3-2*/[^\W\dmpf_]/i;s.[a-z]{$p}.vec($f=join('',$p-1?chr(sub{$_[0]*9+$_[1]*3+
$_[2]}->(map{/p|f/i+/f/i}split//,$&)+97):qw(m p f)[map{((ord$&)%32-1)/$_%3}(9,
3,1)]),5,1)='`'lt$&;$f.eig; # Jan-Pieter Cornet
_______________________________________________
NOTE: If there is a disclaimer or other legal boilerplate in the above
message, it is NULL AND VOID. You may ignore it.
Visit http://www.mimedefang.org and http://www.roaringpenguin.com
MIMEDefang mailing list [email protected]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
