Hello David,
Wednesday, June 9, 2004, 11:19:39 AM, you wrote:
DBF> On Wed, 9 Jun 2004, Paolo Cravero as2594 wrote:
>> What surprises me is the presence of X-UIDL header in a SMTP envelope.
>> Moreover the X-UIDL value is non-numeric! Has anyone blocked this thing?
>> Any special rule? (I can write my own if there's none around) Any reason
>> why it is there?!
DBF> I've seen X-UIDL headers used by legimate mail-list sites, but they
DBF> were all long (10-40 character) hexidecimal numbers.
DBF> I've seen a modest amount of spam use those 'garbage' X-UIDL headers
DBF> and created this rule:
DBF> header L_BAD_UIDL X-UIDL =~ /\W\W/
DBF> describe L_BAD_UIDL Bad UIDL header
DBF> score L_BAD_UIDL 2.5
DBF> Havn't seen any FPs from it so far.
Sorry to be the bearer of bad news, but your rule hits lots of ham here:
(First numeric frequencies, followed by percentage frequencies)
OVERALL SPAM HAM S/O SCORE NAME
85107 62393 22714 0.733 0.00 0.00 (all messages)
696 21 675 0.011 0.00 2.50 L_BAD_UIDL
OVERALL% SPAM% HAM% S/O RANK SCORE NAME
85107 62393 22714 0.733 0.00 0.00 (all messages)
100.000 73.3112 26.6888 0.733 0.00 0.00 (all messages as %)
0.818 0.0337 2.9717 0.011 0.00 2.50 L_BAD_UIDL
Sample ham hits:
# L_BAD_UIDL="!!"
# L_BAD_UIDL=""!"
# L_BAD_UIDL="@""
# L_BAD_UIDL=""!"
# L_BAD_UIDL="'#"
# L_BAD_UIDL=""!"
# L_BAD_UIDL="$@"
# L_BAD_UIDL=")!"
# L_BAD_UIDL="\""
# L_BAD_UIDL="#>"
# L_BAD_UIDL="\;"
# L_BAD_UIDL="$!"
# L_BAD_UIDL=""!"
# L_BAD_UIDL="<""
# L_BAD_UIDL="^""
# L_BAD_UIDL=";!"
Bob Menschel
