Take care with Xerox versions, it just changed. I mentioned this in my reply to Kris.
I do not trust PHP Mailers, as PHP is wrong by design. Alex, from prypiat. Yes, I recycle. On 12-11-30 10:17 AM, Kris Deugau wrote: > John Hardin wrote: >> On Thu, 29 Nov 2012, Kris Deugau wrote: >> >>> I've just had another couple of reports of false positives due to hits >>> on one or more of the FROM_MISSP_* rules. >>> >>> Curious coincidence: Almost all of the reports to date have involved >>> webform email for real estate companies. Most of the rest have involved >>> scan-to-email multifunction devices - mostly Xerox.... used by real >>> estate companies. O_o >> Is there any possibility of getting user agent headers for these FPs? If >> a particular piece of legit software always does this then obviously >> those rules should ignore such messages. > The most recent scan-to-email had: > > X-Mailer: WorkCentre 7428 > > and another couple of older ones showed: > > X-Mailer: WorkCentre 7435 > > Walking Xerox's list of scan-to-email-capable devices will probably turn > up another couple of possible model numbers. > > Digging back in the FP archive, there are a handful of webform messages > with "X-Mailer: PHP4", and none of the rest have even that much. > > None of the ones I've had reported are from desktop or mobile MUAs. > > Two are from airlines - one an ezine from Air Canada, the other a > receipt/itinerary from Air Creebec. > > -kgd
signature.asc
Description: OpenPGP digital signature
