You're probably right, though I'd still be willing to wager there's some
positive benefit. E.g. some spammer may have started with a bug in their
software, then noticed multiple From addresses are filtered less than single
From addresses and decided the bug was a feature. If it fewer spams got
through because of it, you can be sure they'd have fixed it. In any case, it's
a win for us because now we can filter on it. I've never seen any legitimate
messages with multiple From addresses; if any non-spam software does this, it's
not in wide usage.
Sorry I wasn't clear, the pattern would be used with the header blacklist
filter. So you could put it in a config file like this:
header-blacklist-entry=From:*>,*<*
Or you could use the header-blacklist-file option if you want to put a bunch of
patterns in a file.
-- Sam Clippinger
On Dec 8, 2012, at 7:54 PM, Angus McIntyre wrote:
> Sam Clippinger wrote:
>> How interesting. I wonder why they're doing that -- do they think a mail
>> agent will check all of the addresses in the address book and refuse to
>> junk the message if one is found?
>
> "Never attribute to malice that which can be adequately
> explained by stupidity." -- Hanlon's Razor
>
> This goes double for spammers.
>
> In the example given, the addresses in the 'From' line matched the
> addresses in the 'To' line. My guess would be that poorly-written software
> is somehow to blame. Perhaps someone took a function that was originally
> written to target a single address and started passing a string containing
> multiple addresses, forgetting that the function puts the same value in
> both 'To' and 'From' fields. Or perhaps something isn't splitting out
> multiple addresses properly.
>
>> Anyway, with the example you gave, you should be able to stop it with
>> this:
>> From:*>,*<*
>
> Out of curiosity, which config file would this go into?
>
> Angus
>
> --
>
>
> _______________________________________________
> spamdyke-users mailing list
> [email protected]
> http://www.spamdyke.org/mailman/listinfo/spamdyke-users
_______________________________________________
spamdyke-users mailing list
[email protected]
http://www.spamdyke.org/mailman/listinfo/spamdyke-users
