Nope these are bogus. I have seperate rules for them in the last Rule Emporeum update. I used seperate, as they often are seen in pairs. Although I didn't tag X-Email, because I'm not sure about that one.
--Chris Santerre > -----Original Message----- > From: Regis Wilson [mailto:[EMAIL PROTECTED] > Sent: Tuesday, October 21, 2003 2:58 PM > To: [EMAIL PROTECTED] > Subject: [SAtalk] [RD] simple rule for consumption > > > Recently had some false negatives come through. Most of them > are one sentence > saying hello, and a URL. I noticed some strange headers, listed here: > > X-E: > X-I: > X-ENVID > X-Email > > So I wrote a quickie rule and it catches about 126 spam per week. > > header BAD_HEADERS ALL =~ /X-(?:E|Email|ENVID|I):/ > describe BAD_HEADERS Header uses spammy X- header > score BAD_HEADERS 3.0 > > Is X-ENVID a potential false-positive? I haven't seen any > "legitimate" use > for it. > > > ------------------------------------------------------- > This SF.net email is sponsored by OSDN developer relations > Here's your chance to show off your extensive product knowledge > We want to know what you know. Tell us and you have a chance > to win $100 > http://www.zoomerang.com/survey.zgi?HRPT1X3RYQNC5V4MLNSV3E54 > _______________________________________________ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk > ------------------------------------------------------- This SF.net email is sponsored by OSDN developer relations Here's your chance to show off your extensive product knowledge We want to know what you know. Tell us and you have a chance to win $100 http://www.zoomerang.com/survey.zgi?HRPT1X3RYQNC5V4MLNSV3E54 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
