Thanks.
. I'm sure it goes without saying that MIME decoding would be a nice addition whenever that pops to the top of your to-do list. This one message was clearly obfuscated using that technique, and the sender was careful to find a free mail provider that would send quoted-printable encoding headers on plain text messages. This is most problematic on Nigerian scams because it almost always comes from legitimate mail providers and you have to rely exclusively on content filters to block it, although I'm now starting to populate a %MAILFROMBL% test for such addresses, and I should soon see how useful that may be.
Matt
R. Scott Perry wrote:
I'm finding this difficult to test and thought that I would ask it instead. I've found some heavy obfuscation in some Nigerian stuff that has be scratching my head about how to filter it. One such messages contains the following:
THE OWNER OF THIS ACCOUNT LATE MR.DENNIS BR=
OWN ,HE DIED SINCE 1997
I'm wondering to what extent Declude clears up such encoding for the filters. For instance, would the following work in this instance:
BODY 3 CONTAINS MR.DENNIS BROWN
or maybe with a space for the line return: BODY 3 CONTAINS MR.DENNIS BR= OWN
or rather without the space: BODY 3 CONTAINS MR.DENNIS BR=OWN
Declude JunkMail should translate the CRLF (linefeed) into a space, so it the second line ("MR.DENNIS BR= OWN") should catch it.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
-- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =====================================================
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
