At 03:57 09-07-2009, McDonald, Dan wrote:
I recently received a spam with a mailbox-list in the from: and senderd:
headers
From: "Inversiones" <inversiones.fo...@live.com>,
<i...@lasinversionesforex.com>
Sender: "Inversiones" <inversiones.fo...@live.com>,
<i...@lasinversionesforex.com>
Since I had not seen mailbox-lists in a from: header before, I ran to
read rfc5322:
[snip]
Clearly, this message failed this section. Would multiple addresses in
either the From: or Subject: headers be a useful spam rule? Is that
construct used often somewhere that I'm not familiar with?
Did you mean Sender: header instead of Subject: header? Multiple
addresses rarely appear in the From: header. It's better to have a
rule for the multiple addresses in the Sender: header if you are
receiving a lot of spam with the above headers.
Regards,
-sm
