> -----Original Message----- > From: Jan Pieter Cornet > On Tue, Feb 21, 2006 at 09:35:46AM -0600, Richard Laager wrote: > > This makes me thing... Are double From: headers a good indicator of > > spam?
> I'd guess it is. I agree. The only question is - does it occur often enough to warrant a check for it? > Duplicate From: headers are illegal, > according to rfc 2822 (section 3.6.1). However, you can have > multiple addresses in one From: header. You can only have multiple addresses in From:, if there is an accompanying Sender: header to indicate which one actually sent it. I've never seen a legitimate use for it though. > A quick check finds 3 examples of this in my recent spam, and > zero in ham, but that's a real quick and limited check over > like 1500 messages. A quick check of the quarantine folders here finds 1 double from, and 2 with no from line at all. All three of them look like they were generated by overloading a vulnerable web script. _______________________________________________ NOTE: If there is a disclaimer or other legal boilerplate in the above message, it is NULL AND VOID. You may ignore it. Visit http://www.mimedefang.org and http://www.roaringpenguin.com MIMEDefang mailing list [email protected] http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
