2 line returns in subject line = spam

Tig tigger at onemoremonkey.com
Fri Feb 6 10:05:55 CET 2004


I've started getting spam with what 'appears' to be two line returns in
the subject line. I say 'appears' because I have no idea if this is on
purpose (some ascii character maybe), my email client (Sylpheed Claws,
v0.9.8), bogofilter or qmail.

Its pretty hard (for me) to work out where on the chain the second line
return is happening and how.

I guess, my question is. Is anyone else seeing spam like this? The
reason this is a pain, is because I filter on the X-Bogosity header,
which is now part of the message body and no longer a header.

Sample headers are below

Return-Path: <Candy at frontiernet.net>
Delivered-To: tigger at i.removed.this
Received: (qmail 82139 invoked from network); 6 Feb 2004 05:44:15 -0000
Received: from unknown (HELO nod.phpwebhosting.com) (64.239.39.77)
  by eeeor.goo with SMTP; 6 Feb 2004 05:44:15 -0000
Received: (qmail 15113 invoked by uid 457); 6 Feb 2004 05:43:03 -0000
Delivered-To: onemoremonkey.com-tigger at onemoremonkey.com
Received: (qmail 15111 invoked by uid 508); 6 Feb 2004 05:43:03 -0000
Received: from unknown (HELO adsl-68-251-31-18.dsl.sbndin.ameritech.net)
(68.251.31.18)  by nod.phpwebhosting.com with SMTP; 6 Feb 2004 05:43:03
-0000 X-Authentication-Warning: enthalpy apotheosis candela 
Date: Fri, 06 Feb 2004 04:35:07 -0100
From: Francisca <Candy at frontiernet.net>
Reply-To: Francisca <Candy at frontiernet.net>
Message-ID: <766719533.78099091 at zzzjusac>
To: tigger at onemoremonkey.com
Subject: Solve your Insecurities - Fast And Easy Instant Growth Formula

References: <0888317655341.tigger at onemoremonkey.com>
In-Reply-To: <0888317655341.tigger at onemoremonkey.com>
X-Mailer: dusseldorf morrow 
MIME-Version: 1.0
Content-Type: multipart/alternative;
 boundary="--663850909172051779"
X-Bogosity: Yes, tests=bogofilter, spamicity=1.000000, version=0.15.13.2

----663850909172051779
Content-Type: text/plain; charset="ascii-us"
Content-Transfer-Encoding: quoted-printable




More information about the Bogofilter mailing list