| Author |
Message |
Boris Lokhvitsky
Guest
|
 Posted:
Tue Nov 16, 2004 12:38 am Post subject:
Event sink for changing X-headers |
|
|
Hi All,
Almost programming question here:
Is it possible to write event sink (or use any third party tool) for
changing X-headers in the incoming messages? The task is to remove some
excessive X-headers sent by spammers, before the message is accepted by the
information store.
Any advise or link will be highly appreciated.
Thanks,
Boris
|
|
| Back to top |
|
 |
Karakas, Gyula [vamsoft]
Guest
|
| Posted:
Tue Nov 16, 2004 1:42 pm Post subject:
Re: Event sink for changing X-headers |
|
|
Boris,
you can find a few example scripts here:
http://www.vamsoft.com/orf/tools.asp
and an example of removing a header line at:
http://www.vamsoft.com/orf/howto-readreceipt.asp
HTH
Gyula Karakas
orf support
www.vamsoft.com/orf
Boris Lokhvitsky wrote:
| Quote: | Almost programming question here:
Is it possible to write event sink (or use any third party tool) for
changing X-headers in the incoming messages? The task is to remove
some excessive X-headers sent by spammers, before the message is
accepted by the information store.
Any advise or link will be highly appreciated. |
|
|
| Back to top |
|
|
Boris Lokhvitsky
Guest
|
| Posted:
Wed Nov 17, 2004 7:51 am Post subject:
Re: Event sink for changing X-headers |
|
|
Thanks Gyula,
it's very interesting.
I see the problem in my case, though, because I don't know in advance what
will be the exact names of these X-headers. All I know is that they are
constructed as a combination of two randomly chosen words. These headers hit
Exchange information store, overflow the headers storage, and create DoS
conditions. Here are some examples (very weird):
abdominothoracic-birthplace
absolute-anteconsonantal
abundancy-canorously
accelerando-armilla
accretal-bedark
acidosteophyte-adipopexia
acronically-bronchotome
adjunction-Argean
adjunctively-bullfighting
adularescence-aval
adverseness-akepiro
aeronef-betoil
aeruginous-alalus
afghanistan-bacterial
afterwards-bicornuate
Agathis-albinuria
agentship-allegorister
aigialosaur-cartmaking
aire-bocher
airward-ceraunoscope
aliphatic-Albireo
allalinite-calibered
Amaryllidaceae-Bahaullah
Amblyopsidae-autoscopic
aminoacetophenone-cannonry
Amitabha-bardlike
amminolytic-abox
amulla-cadaverously
anally-Caesarism
Anybody ever encountered that?
"Karakas, Gyula [vamsoft]" <gyula karakasATvamsoft com> wrote in message
news:xn0dptt1s15wnm000@msnews.microsoft.com...
| Quote: | Boris,
you can find a few example scripts here:
http://www.vamsoft.com/orf/tools.asp
and an example of removing a header line at:
http://www.vamsoft.com/orf/howto-readreceipt.asp
HTH
Gyula Karakas
orf support
www.vamsoft.com/orf
Boris Lokhvitsky wrote:
Almost programming question here:
Is it possible to write event sink (or use any third party tool) for
changing X-headers in the incoming messages? The task is to remove
some excessive X-headers sent by spammers, before the message is
accepted by the information store.
Any advise or link will be highly appreciated. |
|
|
| Back to top |
|
|
Karakas, Gyula [vamsoft]
Guest
|
| Posted:
Wed Nov 17, 2004 4:36 pm Post subject:
Re: Event sink for changing X-headers |
|
|
This rather seems to be malformed spam emails, these random words are
used to confuse Bayesian methods. Your problem might be that the actual
message is bad, i.e. the message does not contain an empty line after
the headers so these words are treated as header information.
To confirm this you should examine the full MIME message. This cannot
be done with outlook as it only shows partial header information, but
using another MUA - like outlook express - you can get the email in
question via POP3 or IMAP.
If this is the problem I do not think too much can be done - use some
kind of spam protection, if you have not done this already.
Gyula Karakas
orf support
www.vamsoft.com/orf
Boris Lokhvitsky wrote:
| Quote: | I see the problem in my case, though, because I don't know in advance
what will be the exact names of these X-headers. All I know is that
they are constructed as a combination of two randomly chosen words.
These headers hit Exchange information store, overflow the headers
storage, and create DoS conditions. Here are some examples (very
weird):
abdominothoracic-birthplace
absolute-anteconsonantal
abundancy-canorously
accelerando-armilla
accretal-bedark
acidosteophyte-adipopexia
acronically-bronchotome |
|
|
| Back to top |
|
|
|
|
|
|
FAQ
Memberlist
Register
Profile
Log in to check your private messages
Log in