At 03:42 PM 3/10/2008, John Hardin wrote:
This just squeaked past my SA:
{snip}
Date: Mon, 10 Mar 2008 17:38:53 -0400
from: "greg martind" <[EMAIL PROTECTED]>
Message-ID: <[EMAIL PROTECTED]>
MIME-Version: 1.0
subject: [SPAM] GOOD EMPLOYMENT OFFER
to: [EMAIL PROTECTED]
X-Authenticated: #46068547
{snip}
The all-lowercase headers immediately caught my eye.
There doesn't appear to be a way to check for headers in a
case-sensitive manner short of a plugin or (maybe) a "full" rule. Am
I missing something?
After a quick troll through my corpus it looks like from, to and
subject headers all in lowercase might be a useful spam sign - if
there was a way to check them.
Comments?
Well, your subject was all upper case, so so much for that idea. ;)
I've seen plenty of all lower case from / to ham, so YMMV as they say.
