Yahoo's own DKIM implementation? header signing?
I usually see very small < 100 chars in this header, but sometimes, I
see HUGE, 8000 char X-YMail-OSG headers
(always in spam)
Rumor has it, that this gets bigger the more recipients are in the
email, including Bcc recipients.
Anyone run a check on the correlation between the length of the
X-YMail-OSG header and spam/ ham?
Justin: you have a gook 'zero day spam' and FP ham corpus, what does it
show?
would adding 1 point for each 1K of header length help?
--
Michael Scheidell, CTO
Phone: 561-999-5000, x 1259
> *| *SECNAP Network Security Corporation
* Certified SNORT Integrator
* 2008-9 Hot Company Award Winner, World Executive Alliance
* Five-Star Partner Program 2009, VARBusiness
* Best Anti-Spam Product 2008, Network Products Guide
* King of Spam Filters, SC Magazine 2008
______________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r).
For Information please see http://www.secnap.com/products/spammertrap/
______________________________________________________________________
