Today's version has a Subject of this form:
FW: Notification from WORD WORD
...where WORD WORD varies per message but is always all caps. The three
Content-Type lines Chip mentioned are the same, and they are the only ones
that should be used for rtf. The name is similar, repeating the same
variable as in the Subject, for example:
Content-Type: application/octet-stream;
name="Invoice_ZLINV54216_from_WORD WORD.rtf"
There is a space in the file name. The variable ZL string is not in the
Subject today. I don't have a full sample, just what we've logged, so I
can't say whether the unusual X- headers continue.
Spamhaus knows most of the hosts they are sending from.
Joseph Brennan
Columbia University Information Technology
