timonecomcastnet tim peters barry warsaw gives answers asks questions heres code produced header tokens x2n x msgkeys x2nx x2ngetx 0 1 x x2nitems yield headersd x responses 001 19 3559 headerxmailmanversion1 001 19 3559 headerlistid1 001 19 3557 headerxbeenthere1 three definitely mm artifacts although second one could inserted list management software described rfc since ham came mailman 19 spam quite safe assume ignore 001 0 3093 headernewsgroups1 001 0 3054 headerxref1 001 0 3053 headerpath1 arent mm artifacts byproducts gating message nntp feed nntp headers similar wont point ignore 001 19 2668 headerlistunsubscribe1 001 19 2668 headerlistsubscribe1 001 19 2668 headerlistpost1 001 19 2668 headerlisthelp1 001 19 2668 headerlistarchive1 rfc recommended generic listserve headers mm injects ditto get two entries one 099 519 0 headerreceived8 099 466 1 headerreceived7 read code first line counts msgs 8 instances received header second counts msgs 7 instances expect good clue indirect mail path thingies well see youre posting spam trailer park tasmania may well need travel thru machines note header names case insensitive ones different mimeversion similarly headers list ignoring case may may help thats experiment decide plausible case significant eg particular spam mailing package generates unusual case particular clueless spammer misconfigures package 002 65 3559 headerprecedence1 could mailman header supposed tell automated software message automated eg replybot ignore message precedence bulkjunklist rule thumb mailman inserts thing ignore better stop trying outthink flaws test data get better test data instead 050 4 0 header21 050 0 2 header heh sucked wordinfo keys began header last line probably due unrelated instances string header message bodies harder guess first line headers course totally unreliable origin im thinking stuff like mimeversion contenttype etc etc everyone sticks brilliance anthonys count scheme requires thought cant fooled header lines evenly distributed across spam ham turn worthless indicators prob near 05 harm fri 06 sep 2002 124509 0400 spambayes test sets