Keith Flippin said:
>
> Now I've got one for which I can't determine the proper taboo field. We
> got three messages, all with different From and To headers, but with
> rather similar Received headers. Here's the first one:
>
> Received: from mail.apache.net(really [164/187]) by relay.comanche.com
The owner of apache.net has assured us that apache.net is not a
player, but that their name seems to be forged in some Spam
software. Thus, if you can be sure of never recieving something from
or via apache.net, you could use it as a taboo_header. Not a perfect
fix.
> Authenticated sender is <[EMAIL PROTECTED]>
Ah yes, our old friend "Email Marketing Works". 'Authenticated
sender' in the body is usually a dead giveaway of Bulls Eye Gold.
Perfect for taboo_body.
--bill
