After studying AOL headers, as well as other ISPs, I have added a header
check after SA via Procmail. Below is my check:
#
#### AOL
#
:0
* ^(X-Merlin-MailFrom|From):.*aol\.com
{
:0 fw
* 1^0 !^Received: [EMAIL PROTECTED]
* 1^0 !.*by imo.*\.mx\.aol\.com
* 1^0 !^Message-ID:[EMAIL PROTECTED]
* 1^0 !^X-Mailer:.*(AOL|Atlas|Windows sub|6\.0 sub)
| formail -A "X-Merlin: Header Failed - AOL"
}
--Larry
> -----Original Message-----
> From: Chris Santerre
> Is this ever possible to be legit? See the received domain of
> zzn.com and the user agent at the bottom of AOL 7. Seems to me this
> is a sure fire spam tag.
>
> Received: from beatle.zzn.com ([61.171.144.236])
> by moglobal.com (8.12.5/8.12.5) with SMTP id h759N1Fu021390
> for <[EMAIL PROTECTED]>; Tue, 5 Aug 2003
> 05:23:03 -0400
> Message-ID: <[EMAIL PROTECTED]>
> Reply-To: "karyl" <[EMAIL PROTECTED]>
> From: "karyl" <[EMAIL PROTECTED]>
> To: "Lorretta Palmer" <[EMAIL PROTECTED]>
> Subject: *****SPAM***** Successful judgment recovery business
> Date: Mon, 04 Aug 2003 21:07:07 -1100
> MIME-Version: 1.0
> Content-Type: multipart/alternative;
> boundary="----=_NextPart_B31_C524_51061546.3823D0DE"
> X-Priority: 3
> User-Agent: AOL 7.0 for Windows US sub 118
>
>
> I'm thinking a simple meta of user-agent AOL, but recieved
> header or from having no AOL.
>
-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
