Hi,

To clarify, I searched 50K messages for -i stormpost, not the regex below.

Regards,

Rick

----- Original Message -----
From: "Daniel Quinlan" <[EMAIL PROTECTED]>
To: "Brian May" <[EMAIL PROTECTED]>
Cc: <[EMAIL PROTECTED]>
Sent: Friday, May 31, 2002 7:34 PM
Subject: Re: [SAtalk] Strange Headers...


Brian May writes:

> Has anyone seen this header before? Google had no matches.
>
> X-Stormpost-To: <emailaddy> <numbers, possibly web bugs>
>
> It was one of the headers of spam that got through...

Yep.  It's from Stormpost which appears to be a spam program.  There's
probably a "X-Mailer: StormPost 1.0" header in your message too.

I'm currently testing a RATWARE_HEADER rule.  These are the most
frequent headers I have found in spam, but never found in non-spam.
Some of these headers seem innocuous, so I'm a tad nervous about
checking it in, but I've checked a lot of legitimate email without
finding any matches.

  header   RATWARE_HEADER         ALL =~
/\n(?:mailing-list|x-em-registration|x-em-version|x-esmtp|x-list-host|x-list
-unsubscribe|x-message-id|x-precedence-ref|x-smtpexp-registration|x-smtpexp-
version|x-stormpost-to|x-x):/is
  describe RATWARE_HEADER         Bulk email software header

Dan

_______________________________________________________________

Don't miss the 2002 Sprint PCS Application Developer's Conference
August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm

_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk



_______________________________________________________________

Don't miss the 2002 Sprint PCS Application Developer's Conference
August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm

_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Reply via email to