[Zope-Coders] Suspicious Headers?!

[Ken Manheimer]

On Tue, 14 May 2002, Chris Withers wrote:

> Martijn Pieters wrote:
> > 
> > On Tue, May 14, 2002 at 03:13:54PM +0100, Chris Withers wrote:
> > > Use spamassassin, it's great :-)
> > 
> > We already use SA. Thought you knew that. But the test messages are awfully
> > thin for SA to get a grip on, and the envelope sender constantly changes.
> 
> Funny, our SA has killed all of them...

Really?  Are you talking about the same thing?

Every several days for a week or two now we've been getting several - 8,
10, or 12 - messages over the course of the day, with the subject "test"
and an origin that differs from the batch of these nuisances.  Spam
Assassin hasn't been catching them - i assume those of you on Zope-Coders
has been noticing the few that got through, before i set up a
domain-specific rule from them.

Finally, it looks like we needed to catch these nuisances even when they
come from a new domain, so we set up a rule that captures messages with
the header "subject: test".  Oddly (for those of us who thought we were
familiar with mailman), it seems to be capturing messages with a subject
line that contains the word "test", which is *not* what we want.  Not sure 
what's going on there, and with no time to read the source and fix it, 
we're punting for now - hopefully barry (or anyone who wants to suggest an 
informed alternative) will have a moment to tell us the right way to 
handle this situation.

-- 
Ken
klm@zope.com