On Sat, Dec 27, 2003 at 10:50:18AM -0500, Fred
carved this out of pure phosphors:
>
> Something about this causes it to hit on every message which does not
> contain a X-Originating-IP header. I think you need a meta test to check if
> that tag exists before checking if it *doesn't* contain that
- Original Message -
From: "Anthony Martinez" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, December 25, 2003 11:23 PM
Subject: [SAtalk] X-Originating-IP isn't a number
> I got a spam today where the X-Originating-IP header wasn't
I got a spam today where the X-Originating-IP header wasn't a number. Hotmail
always puts the dotted quad in the header.
I wrote a rule to match this - I hope it's useful.
header XORIG_IP_NOT_NUMBER X-Originating-IP !~ /\[[\d\.]*]/
describe XORIG_IP_NOT_NUMBERThe X-Originating-IP header
