[Mimedefang] Double From: lines in email

Jan Pieter Cornet johnpc at xs4all.nl
Tue Feb 21 16:20:13 EST 2006

On Tue, Feb 21, 2006 at 09:35:46AM -0600, Richard Laager wrote:
> This makes me thing... Are double From: headers a good indicator of
> spam?

I'd guess it is. Duplicate From: headers are illegal, according to
rfc 2822 (section 3.6.1). However, you can have multiple addresses in
one From: header.

A quick check finds 3 examples of this in my recent spam, and zero
in ham, but that's a real quick and limited check over like 1500

I wouldn't mind blocking email on sillyness like this. If there ever is
a legitimate site doing it, you can at least slap them with the RFC and
explain they were doing something REALLY bizarre.

#!perl -wpl # mmfppfmpmmpp mmpffm <pmmppfmfpppppfmmmf at fpffmm4mmmpmfpmf.ppppmf>
$_[2]}->(map{/p|f/i+/f/i}split//,$&)+97):qw(m p f)[map{((ord$&)%32-1)/$_%3}(9,
3,1)]),5,1)='`'lt$&;$f.eig;                                # Jan-Pieter Cornet

More information about the MIMEDefang mailing list