This just squeaked past my SA:
{snip}
Date: Mon, 10 Mar 2008 17:38:53 -0400
from: "greg martind" <[EMAIL PROTECTED]>
Message-ID: <[EMAIL PROTECTED]>
MIME-Version: 1.0
subject: [SPAM] GOOD EMPLOYMENT OFFER
to: [EMAIL PROTECTED]
X-Authenticated: #46068547
{snip}
The all-lowercase headers immediately caught my eye.
There doesn't appear to be a way to check for headers in a case-sensitive
manner short of a plugin or (maybe) a "full" rule. Am I missing something?
After a quick troll through my corpus it looks like from, to and subject
headers all in lowercase might be a useful spam sign - if there was a way
to check them.
Comments?
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
[EMAIL PROTECTED] FALaholic #11174 pgpk -a [EMAIL PROTECTED]
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
W-w-w-w-w-where did he learn to n-n-negotiate like that?
-----------------------------------------------------------------------
4 days until Albert Einstein's 129th Birthday
