On Mon, 10 Mar 2008, Daryl C. W. O'Shea wrote:
On 10/03/2008 6:42 PM, John Hardin wrote:
This just squeaked past my SA:
{snip}
Date: Mon, 10 Mar 2008 17:38:53 -0400
from: "greg martind" <[EMAIL PROTECTED]>
Message-ID: <[EMAIL PROTECTED]>
MIME-Version: 1.0
subject: [SPAM] GOOD EMPLOYMENT OFFER
to: [EMAIL PROTECTED]
X-Authenticated: #46068547
{snip}
The all-lowercase headers immediately caught my eye.
They're not uncommon in ham either, though.
See my followup - I was speaking of the header *names* being all
lowercase, not their content. Sorry for not making that clearer in my
initial post.
There doesn't appear to be a way to check for headers in a
case-sensitive manner short of a plugin or (maybe) a "full" rule. Am I
missing something?
After a quick troll through my corpus it looks like from, to and subject
headers all in lowercase might be a useful spam sign - if there was a
way to check them.
Do header checks with the ALL, ALL-UNTRUSTED or ALL-EXTERNAL headers.
Does that let you check the header names? Or just the content of headers
regardless of their name?
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
[EMAIL PROTECTED] FALaholic #11174 pgpk -a [EMAIL PROTECTED]
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
The difference is that Unix has had thirty years of technical
types demanding basic functionality of it. And the Macintosh has
had fifteen years of interface fascist users shaping its progress.
Windows has the hairpin turns of the Microsoft marketing machine
and that's all. -- Red Drag Diva
-----------------------------------------------------------------------
4 days until Albert Einstein's 129th Birthday
