A recent thread on webdesign-l discussing X-Mailer values strayed onto spam filtering by X-Mailer. Steve came up with a regexp that that matches 8.8.32 strings (which looks to generate no false positives – pure spam).

If I loosen up the match thusly:

/w{6,8}.w{6,8}.w{16,}/

I get 27 of 94653: 0.028525% and 144 of 6329: 2.275241% for non-spam

and spam, respectively. And if I actually pay attention to the files

in which I’m finding these X-Mailers, I discover that every last one

of them is either on SPAM-L or in a spam message I forwarded to an

abuse address. Voila. It’s a definite 100% spam signature. Cool.

:0

* ^X-Mailer:.*w{6,8}.w{6,8}.w{16,}

> /dev/null