On Thu, 2008-02-07 at 20:15 +0100, Per Jessen wrote:
> Paul Douglas Franklin of Yakima UGM wrote:
>
> > I have noticed that spammers are putting dead giveaways into some of
> > the headers which are not checked with the body rules. Specifically,
> > I received an email with a sender name that was obviously spam.
>
> How did you determine that the sender name made the email "obviously
> spam" ?
Well, a few typical examples I've seen in the past couple hours (email
addresses munged):
Cilais <[EMAIL PROTECTED]>
Ciails <[EMAIL PROTECTED]>
Amazing Watches <[EMAIL PROTECTED]>
Most Trusted Replica <[EMAIL PROTECTED]>
Cartier Replica <[EMAIL PROTECTED]>
However, even though spammers seem to shift some "body" into the user
visible From header, as far as I am concerned, I don't really see a need
to make SA treat the real-name part as body. The Subject tends to hold
the same [1] info. As does the body.
All those examples are really big scorers anyway -- score of 16+, Bayes
confidentiality of 99%, and they hit at least one known-to-be-good
blacklist (IP and URI).
guenther
[1] Well, or similar. I have seen advertisement for Replica Watches
(Subject) with a From of Replica Purses. And vice versa. ;)
--
char *t="[EMAIL PROTECTED]";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
