John D. Hardin wrote: >On Sat, 24 Jun 2006, Philip Prindeville wrote: > > > >>the text and the images. The spammers send multipart/alternative >>because they want the text/plain section to confuse the Bayes >>filters, since they know it won't be rendered... >> >> > >It seems to me that right there is the spam sign you should be looking >for, then, and save all the heavy-duty mathematical analysis of the >images themselves. > >
A lot of mailers generate multipart/alternative legitimately, though if you ask me sending both text/plain and text/html is bogus and no one should configure their mailer to do that. -Philip
