[Mimedefang] Double From: lines in email

[Jan Pieter Cornet]

On Tue, Feb 21, 2006 at 09:35:46AM -0600, Richard Laager wrote:
> This makes me thing... Are double From: headers a good indicator of
> spam?

I'd guess it is. Duplicate From: headers are illegal, according to
rfc 2822 (section 3.6.1). However, you can have multiple addresses in
one From: header.

A quick check finds 3 examples of this in my recent spam, and zero
in ham, but that's a real quick and limited check over like 1500
messages.

I wouldn't mind blocking email on sillyness like this. If there ever is
a legitimate site doing it, you can at least slap them with the RFC and
explain they were doing something REALLY bizarre.

-- 
#!perl -wpl # mmfppfmpmmpp mmpffm <pmmppfmfpppppfmmmf at fpffmm4mmmpmfpmf.ppppmf>
$p=3-2*/[^\W\dmpf_]/i;s.[a-z]{$p}.vec($f=join('',$p-1?chr(sub{$_[0]*9+$_[1]*3+
$_[2]}->(map{/p|f/i+/f/i}split//,$&)+97):qw(m p f)[map{((ord$&)%32-1)/$_%3}(9,
3,1)]),5,1)='`'lt$&;$f.eig;                                # Jan-Pieter Cornet