Scott, Not sure how feasible it is, but a large number of spam mails contain a URL with an IP address (http://127.0.0.1/), I know legitimate mail can too, but as a weighted test it could be useful. I was thinking as part of the filter test, but even as a stand alone test it might work. Most of the porn spam that gets through uses this, and much of the others.
Thanks, Chuck Frolick ArgoNet, Inc. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". You can E-mail [EMAIL PROTECTED] for assistance. You can visit our web site at http://www.declude.com .
