new spam emails getting through..

[Raymond Dijkxhoorn]

Hi!

> > I find that the mere presence of the X-Message-Info header is
> > a sure spam sign. The rule below hit 499 spam and zero false
> > positives over the last four weeks here.

> > header   local_XMESSAGEINFO exists:X-Message-Info
> > describe local_XMESSAGEINFO X-Message-Info header found in message
> > score    local_XMESSAGEINFO 2.0

> Good catch!  Of the 399 emails we've received with that header over the last
> 60 days, 399 are definite spam.  I'm tempted to score it higher.

Dit some grepping on a couple of large spam boxes we use for purpused like
this. A LOT had those headers inside, legit mail we only saw very few. We
scored it 2.5 for now.

Bye,
Raymond.

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html