Only the last header of repeated X headers generated by spam software is being retained by the parse method.
The headers are: X-Spam-Flag, X-Spam-Score, X-Spam-Level, X-Spam-Status (see example header below and the attached email
sample). In the header below, the TMail parse method retains the last 'X-Spam-Score' header encountered, i.e. it retains
the header with the value of '*****' instead of the one with '16.07'.
Return-Path: <>
Delivered-To: spam-quarantine
X-Envelope-From: <nlycaznwklq@yourpcstuff.com>
X-Envelope-To: <********@stat.ucla.edu>
X-Quarantine-ID: <u79lpchtlym0>
X-Spam-Flag: YES
X-Spam-Score: 16.07
X-Spam-Level: ****************
X-Spam-Status: Yes, score=16.07 tag=-1000 tag2=6.31 kill=6.31
tests=[BAYES_50=4, HTML_MESSAGE=0.001, NORMAL_HTTP_TO_IP=0.001,
RCVD_IN_DNSWL_MED=2, RCVD_NUMERIC_HELO=2.067, URIBL_RED=0.001,
URIBL_SC_SURBL=4, URIBL_WS_SURBL=4]
Received: from smtp.stat.ucla.edu ([127.0.0.1])
by localhost (mta.stat.ucla.edu [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id u79lpchtlym0 for <********@stat.ucla.edu>;
Mon, 14 Apr 2008 11:43:15 -0700 (PDT)
Received: from smtp-13.smtp.ucla.edu (smtp-13.smtp.ucla.edu [169.232.46.249])
by smtp.stat.ucla.edu (Postfix) with ESMTP id E8037C42DB2
for <********@stat.ucla.edu>; Mon, 14 Apr 2008 11:43:15 -0700 (PDT)
Received: from dino.ess.ucla.edu (dino.ess.ucla.edu [128.97.31.199])
by smtp-13.smtp.ucla.edu (8.14.2/8.14.2) with ESMTP id m3EIhFZM010543
for <********@stat.ucla.edu>; Mon, 14 Apr 2008 11:43:15 -0700
X-geo_ess_ucla_edu_-MailScanner-Watermark: 1208803395.11439@cjEzhdOLK6XsMz6gYSCtog
Received: from zephyr.ess.ucla.edu (zephyr [128.97.31.1])
by dino.ess.ucla.edu (8.13.8+Sun/8.13.8) with ESMTP id m3EIhFhq010692
for <*****@dino.ess.ucla.edu>; Mon, 14 Apr 2008 11:43:15 -0700 (PDT)
Received: from 79.26.30.109 (host109-30-dynamic.26-79-r.retail.telecomitalia.it [79.26.30.109])
by zephyr.ess.ucla.edu (8.12.10+Sun/8.12.10) with ESMTP id m3EIkj1l010876
for <*****@ess.ucla.edu>; Mon, 14 Apr 2008 11:46:46 -0700 (PDT)
Message-ID: <000701c89e5f$04790d3c$05ddcca4@xrdtca>
From: "hobard leanne" <nlycaznwklq@yourpcstuff.com>
To: <*****@ess.ucla.edu>
Subject: *****'s hidden cam video
Date: Mon, 14 Apr 2008 16:55:27 +0000
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0004_01C89E5F.0478ED4C"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.3138
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198
X-geo_ess_ucla_edu_-MailScanner-Information: Please contact the ISP for more information
X-geo_ess_ucla_edu_-MailScanner: Found to be clean
X-geo_ess_ucla_edu_-MailScanner-From: nlycaznwklq@yourpcstuff.com
X-Spam-Status: No
X-Probable-Spam: no
X-Spam-Hits: 4.702
X-Spam-Score: *****
X-Spam-Report: HTML_MESSAGE,NORMAL_HTTP_TO_IP,RCVD_NUMERIC_HELO,URIBL_RED,URIBL_WS_SURBL
X-Scanned-By: smtp.ucla.edu on 169.232.46.249
|
