On Sat, 7 Jun 2014, Karsten Bräckelmann wrote:
On Fri, 2014-06-06 at 19:02 -0700, John Hardin wrote:
On Sat, 7 Jun 2014, Karsten Bräckelmann wrote:
That Return-Path really sticks out. It's basically the From: address
with embedded To: address.
It would be possible to do a multiple-header rule with captures and
backreferences to capture the camel-case, destination email and source
domain parts and verify that the Return-Path+From+To header triplet
matches this pattern.
I bet you by 2 minutes! ;)
:-P
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
We have to realize that people who run the government can and do
change. Our society and laws must assume that bad people -
criminals even - will run the government, at least part of the
time. -- John Gilmore
-----------------------------------------------------------------------
Today: the 70th anniversary of D-Day
