I checked my last 20,000 spam emails and found that 250 of them had bogus "X-Mozilla-Status" headers. I have found no instances of these headers in ham, although I admit that I don't keep nearly as large a corpus of ham as I do spam.
I have created a new bugzilla entry for this: http://bugzilla.mozilla.org/show_bug.cgi?id=260589
I have also created a couple of SpamAssassin rules:
header KP_MOZSTATUS exists:X-Mozilla-Status describe KP_MOZSTATUS X-Mozilla-Status header exists score KP_MOZSTATUS 0.5
header KP_MOZSTATUS2 exists:X-Mozilla-Status2 describe KP_MOZSTATUS2 X-Mozilla-Status2 header exists score KP_MOZSTATUS2 1.0
Thanks to Dave Hooton for catching this. Hopefully we can nip this in the bud before it really gets taken up by spammers.
Kevin
