Hi;
Would it be of any
benefit if we could have a test that could indicate if the FROM address is
different from that of the SEND FROM that Declude detects?
A lot of SPAM
comes from emails that the MAILFROM address is different from the SEND FROM that
Declude identifies.
e.g.
=================================================
To: "Spahr Latta"
<[EMAIL PROTECTED]>
Subject: [37~]Mini Digital Camera Sale
From: "Charbonnet Tatis" <[EMAIL PROTECTED]>
X-Comment: 2Q2Hn
X-Accept-Language: en
X-Priority: 3 (Normal)
X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
Content-Type: multipart/alternative; boundary="q0h5g8Mx78S16u6sH6x0w5EOmo170EMP8KB2Eq5ddx8A0emqGlcNf6q118FbI178h60o2Y6l"
Content-Transfer-Encoding: 7bit
Message-ID: <[EMAIL PROTECTED]>
X-OriginalArrivalTime: 07 Jun 2003 21:46:42.0261 (UTC) FILETIME=[4869A050:01C32D3E]
Date: 7 Jun 2003 14:46:42 -0700
X-IMAIL-SPAM-DNSBL: (BLARS,48824832,127.1.8.48)
X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED]
X-RBL-Warning: NOPOSTMASTER: Not supporting [EMAIL PROTECTED]
X-RBL-Warning: IPNOTINMX:
X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail detected.
X-RBL-Warning: FILTER-BODY: Message failed FILTER-BODY test (152)
X-RBL-Warning: FILTER-SUBJECT: Message failed FILTER-SUBJECT test (502)
X-RBL-Warning: FILTER-BODYURL: Message failed FILTER-BODYURL test (2419)
X-RBL-Warning: FILTER-HEADER-XMAIL: Message failed FILTER-HEADER-XMAIL test (15)
X-Declude-Sender: [EMAIL PROTECTED] [65.54.169.136]
X-Declude-Spoolname: D5d1802e902002e4d.SMD
X-Note: This E-mail was scanned & filtered by Declude [1.70i6] for SPAM & virus.
X-Spam-Tests-Failed: NOABUSE, NOPOSTMASTER, IPNOTINMX, NOLEGITCONTENT, FILTER-BODY, FILTER-SUBJECT, FILTER-BODYURL, FILTER-HEADER-XMAIL, WEIGHT20s, WEIGHT20r
X-Weight: 37
X-Mailfrom: tgeraldtl33a.msn.com
Subject: [37~]Mini Digital Camera Sale
From: "Charbonnet Tatis" <[EMAIL PROTECTED]>
X-Comment: 2Q2Hn
X-Accept-Language: en
X-Priority: 3 (Normal)
X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
Content-Type: multipart/alternative; boundary="q0h5g8Mx78S16u6sH6x0w5EOmo170EMP8KB2Eq5ddx8A0emqGlcNf6q118FbI178h60o2Y6l"
Content-Transfer-Encoding: 7bit
Message-ID: <[EMAIL PROTECTED]>
X-OriginalArrivalTime: 07 Jun 2003 21:46:42.0261 (UTC) FILETIME=[4869A050:01C32D3E]
Date: 7 Jun 2003 14:46:42 -0700
X-IMAIL-SPAM-DNSBL: (BLARS,48824832,127.1.8.48)
X-RBL-Warning: NOABUSE: Not supporting [EMAIL PROTECTED]
X-RBL-Warning: NOPOSTMASTER: Not supporting [EMAIL PROTECTED]
X-RBL-Warning: IPNOTINMX:
X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail detected.
X-RBL-Warning: FILTER-BODY: Message failed FILTER-BODY test (152)
X-RBL-Warning: FILTER-SUBJECT: Message failed FILTER-SUBJECT test (502)
X-RBL-Warning: FILTER-BODYURL: Message failed FILTER-BODYURL test (2419)
X-RBL-Warning: FILTER-HEADER-XMAIL: Message failed FILTER-HEADER-XMAIL test (15)
X-Declude-Sender: [EMAIL PROTECTED] [65.54.169.136]
X-Declude-Spoolname: D5d1802e902002e4d.SMD
X-Note: This E-mail was scanned & filtered by Declude [1.70i6] for SPAM & virus.
X-Spam-Tests-Failed: NOABUSE, NOPOSTMASTER, IPNOTINMX, NOLEGITCONTENT, FILTER-BODY, FILTER-SUBJECT, FILTER-BODYURL, FILTER-HEADER-XMAIL, WEIGHT20s, WEIGHT20r
X-Weight: 37
X-Mailfrom: tgeraldtl33a.msn.com
X-Note: Sent from
Reverse DNS: bay3-dav106.bay3.hotmail.com ([65.54.169.136]).
X-Hello: hotmail.com
X-Hello: hotmail.com
=================================================
I guess one
problem with this would be the listservs - but to me it seems like that could be
a good test for a weight test.
Regards,
Kami
