Hmm, 2 interesting things in the message there: 1. X-UIDL is often added by legitimate mailer like UW-IMAP and such, but that format of the string looks suspicious to me.
2. Never before seen a Comment: header containing a unique ID like that C PremierNET Abuse wrote: PA> Return-Path: <[EMAIL PROTECTED]> PA> Received: from arcturus.whitcon.net (arcturus.whitcon.net [65.171.144.13]) PA> by mail.premiernet.net (8.12.3/8.12.3/Debian -4) with ESMTP id g426Lsdd020945 PA> for <[EMAIL PROTECTED]>; Thu, 2 May 2002 01:21:55 -0500 PA> Received: from localhost (root@localhost) PA> by arcturus.whitcon.net (8.9.3/8.9.3) with SMTP id XAA29958; PA> Wed, 1 May 2002 23:19:53 -0700 PA> Date: Wed, 1 May 2002 23:19:53 -0700 PA> eturn-Path: <[EMAIL PROTECTED]> PA> From: "Sarah" <[EMAIL PROTECTED]> PA> Subject: Sure beats TV. :-) PA> Mime-Version: 1.0 PA> Comment: gdm-4-zfgh PA> To: undisclosed-recipients:; PA> Message-ID: <[EMAIL PROTECTED]> PA> X-Spam-Status: No, hits=4.7 required=5.0 tests=UNDISC_RECIPS,PORN_10,EXCUSE_6,UNSUB_PAGE version=2.20 PA> X-Spam-Level: **** PA> X-UIDL: TFW"!o>R"!Q8b"!mQJ"! PA> Status: RO _______________________________________________________________ Have big pipes? SourceForge.net is looking for download mirrors. We supply the hardware. You get the recognition. Email Us: [EMAIL PROTECTED] _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
