Not completely clear to me what you mean by "odd Message ID tag". Are you
referring to it being "Message-ID" rather than "Message-Id"? Or is that long
batch of underscores part of the actual msgid rather than something you blanked
out?
The first case is (unfortunately) valid, there are several ways to spell that
tag, and the MESSAGEID pseudo-tag in SA catches them.
As for the underscores, I've never noticed that before and am almost positive
we don't have a rule. However, it is trivial to write one for this case:
header MSG_MULT_US MESSAGEID =~ /______/
Loren
-----Original Message-----
From: Steven Stern <[EMAIL PROTECTED]>
Sent: Aug 27, 2004 6:09 AM
To: [email protected]
Subject: test for message ID
I've been getting a lot of porn spam (pam? sporn?) that's mainly HTML links to
images. One thing that seems to be common is that the messages have an odd
Message ID tag from the original sender. For example:
Message-ID: <[EMAIL PROTECTED]>
Is there an existing SARE or other ruleset that picks this up?
--
Steve
