> I've been seeing many messages, perhaps 20 a day, that are truncated.
> Essentially they contain no body. One thing I have found in common is
> a strange value for X-Message-Info:
>
> Here are the rules I wrote to catch these. The value of X-Message-Info
> so far always appears to end in '[1'
I think you can simplify those rules. Just look for X-Message-Info and call
the thing a spam.
As far as I know, that tag only shows up in spams.
BTW, those headers show a common pattern for one of the more prevelent
ratwarez, which is an x-msg-info in front of two fake received headers. But
in this case the kiddie screwed up his cut'n'pasting and broke the
x-msg-info header, and lost the rest of the message also.
Loren
