[prev in list] [next in list] [prev in thread] [next in thread] 

List:       twsocket
Subject:    Re: [twsocket] Problems sending HTML e-mail
From:       "Ian Baker" <ibaker () codecutters ! org>
Date:       2004-01-31 12:00:15
Message-ID: 007301c3e7f1$c9d1a480$642fa8c0 () codecutters ! org
[Download RAW message or body]

----- Original Message ----- 
> Date: Fri, 30 Jan 2004 09:25:03 -0800
> From: "Jeff Hamblin" <jphamblin@cox.net>
> Subject: Re: [twsocket] Problems sending HTML e-mail
> To: "ICS support mailing" <twsocket@elists.org>
> Message-ID: <008c01c3e756$00f9f210$a700a8c0@neo64>
> Content-Type: text/plain; charset="iso-8859-1"
>
> > > >     X-Mailer: Microsoft Outlook Express 6.00.2800.1158
> > > >     X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
> > > How can add this header?
> >
> > You have an OnProcessHeader event. You can add/remove/change any header
> > line.
>
>
> I would caution against spoofing headers, because most
> spam-checking software looks for it. Here is a sample of
> a spam that came in to me, which my ISP flagged as spam
> using SpamAssassin. It is detecting it as a forged Outlook
> mailer, even though the headers look like a normal OE mail.
> Not sure how they detect the difference.
>
> === excerpt from header ===
> X-Mailer: Microsoft Outlook Express 6.00.2800.1158
> X-Priority: 3
> X-MSMail-Priority: Normal
> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
> X-Aplus-MailScanner-Information: Please contact the ISP for more
information
> X-Aplus-MailScanner-SpamCheck: spam, SpamAssassin (score=2.569, required
1,
>  BAYES_50 0.00, FORGED_MUA_OUTLOOK 2.57)
> X-MailScanner-SpamScore: !!

If it's been spoofed correctly, there's no way to tell!

At a quick glance, there is an invalid priority header and the other headers
are in the wrong order.

Drifting OT, so I'll shut-up now ;o)

Regards,

Ian

http://www.codecutters.org/404.html


-- 
To unsubscribe or change your settings for TWSocket mailing list
please goto http://www.elists.org/mailman/listinfo/twsocket
Visit our website at http://www.overbyte.be
[prev in list] [next in list] [prev in thread] [next in thread]