On Fri, Jan 18, 2002 at 11:22:30PM -0500, Jason Kohles wrote:
| On Fri, Jan 18, 2002 at 11:20:29PM -0500, dman wrote:
| >
| > A legit message triggered the
| > FROM_FORGED_HOTMAIL
| > test. The header is
| > From: Linda Macdonald <[EMAIL PROTECTED]>
| >
| > What properites of it make you think it is forged? The test appears
| > to match any hotmail address, legit or not (though I don't really know
| > what the "=~" operator does).
|
| You need to look at the whole test,
Where can I find the rest of the test? The spamassassin.cf file I
have says:
header FROM_FORGED_HOTMAIL From =~ /^[^"]+\S+\@hotmail\.com/i
describe FROM_FORGED_HOTMAIL Forged From: line claiming to be from hotmail.com
score FROM_FORGED_HOTMAIL 3.0
| it DOES match any hotmail address, and
| triggers on any mail that claims to come from hotmail, but doesn't have an
| X-Originating-IP header. Any mail that actually does come from hotmail user
| has this header.
Ok, this makes sense.
However, looking at the false-positive message again, I see
X-Originating-Ip: [4.35.176.66]
X-Originalarrivaltime: 19 Jan 2002 03:55:00.0471 (UTC)
FILETIME=[115D2070:01C1A09D]
in the headers as well. In addition, the first Received: header has
hotmail in it.
TIA,
-D
--
Come to me, all you who are weary and burdened, and I will give you
rest. Take my yoke upon you and learn from me, for I am gentle and
humble in heart, and you will find rest for your souls. For my yoke
is easy and my burden is light.
Matthew 11:28-30
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
