A recent spam where a user collected the addresses from a list of people who have posted to Usenet groups reminded me of this. This particular spammer used Pegasus 2.53 as his email program, which includes a rather useful item. Specifically (quoting from an announcement from David Harris, author of Pegasus mail): ------------- cut here --------------------------------- Pegasus Mail now adds one of three new headers to messages it sends when more than 50 recipients are present in the message. These headers can be used as filtering triggers to delete such messages. The headers are based on the number of recipients, and are as follows: 0-50 recipients - no added header 50-499 recipients - X-Distribution: Moderate 500-4999 recipients - X-Distribution: Bulk 5000+ recipients - X-Distribution: Mass These headers have an internal CRC check applied to them and cannot be changed or omitted by patching the binary. We have deferred announcing the presence of these headers until now in order to give WinPMail v2.5x a chance to propagate widely, and presumably into the hands of a large number of spammers. While spammers using older versions of WinPMail will escape the new headers, they will become progressively further and further out of date and will be unable to take advantage of the newer capabilities of the system without upgrading and thus exposing themselves to automated detection. ------------- resume -------------------------------------- This latest spam indeed did have the X-Distribtion line in the header! Now I'm not suggesting that Listserv begin using these header lines (I'm not *not* suggesting it either), but it is one (little) thing that can be used to filter spams. Of course, right now, Pegasus is the only email program I know using these, so the value of checking for these headers may or may not be all that great. But, if you want to include it in your personal filter rules it can't hurt. Perhaps getting ISP's to use Pegasus as their default distribution could help (hey, TUCOWS rated it as the best pop program out there, and it's totally free)? Is there a way a list could have an exit to pre-filter posts based on this header (or any other) item? If so, is there an example (rexx and perl)?