{"success":true,"data":{"id":"x-php-originating-script","label":"X-PHP-Originating-Script header — sent via PHP mail() from a shared-hosting bulk mailer","description":"The email carries an `X-PHP-Originating-Script` header, which PHP's built-in `mail()` function stamps automatically when `mail.add_x_header` is enabled in php.ini (default on many shared-hosting providers). The header reveals the UID and script path of the process that called mail() — e.g. `1001:send-bulk.php`. No legitimate commercial sender uses PHP's mail() function for outgoing mail: they use Postfix / Exim / Sendmail / transactional APIs (SendGrid, Mailgun, Postmark, SES). The presence of this header is a near-perfect fingerprint of (1) a compromised shared-hosting account running a spam script, (2) a direct PHP bulk mailer operated by a spammer, or (3) an exploited contact form passing user-controlled headers into mail(). Weighted at +4 — strong but not decisive alone because a tiny number of legitimate low-budget newsletters on shared hosting still exist, so it combines with other trash signals rather than solo-triggering deletion.","tier":"danger","category":"header","isThin":false}}