Martin Radford <[EMAIL PROTECTED]> writes: > Hi all, > > I've noticed that I've had a few spams recently where the To: field > includes a DOS-style file path - some examples are: > > To: <C:\`Bulk.Adz\MTG\[EMAIL PROTECTED]> > To: <C:\`Commercial.Adz\Mtg\[EMAIL PROTECTED]> > To: <C:\``VipCustomer\`Euro\[EMAIL PROTECTED]> > To: <C:\``VipCustomer\Yen\[EMAIL PROTECTED]> > To: <C:\``VipCustomer\Dvd\[EMAIL PROTECTED]> > > Is anyone else seeing these?
I have some hits for this, not a huge number (15 hits since August). Definitely worth a try. > It's possible these are generated by the same software - all the > messages I've had also include the following headers: > > Content-Type: text/plain; > charset="Windows-1252" > Content-Transfer-Encoding: 7bit Agreed, it looks like most were done by the same software. A few of mine don't have that header, but spammer software tends to mutate pretty quickly. I tried a rule to look for "Windows-1252" and it has a S/O ratio of about 0.97 for me. That's pretty good, but that's partially due to the fact that (relatively-speaking) few of my non-spam senders are Windows users. -- Daniel Quinlan Linux, open source, and http://www.pathname.com/~quinlan/ anti-spam consulting ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
