We've just added a base64 decoding filter to the Message Sniffer program for precisely this reason. This makes encoded HTML segments or attached files look like plain data to the pattern matching engine. There are other coding tricks in use as well and we are building those filter modules for later release. Once the current beta of sniffer is a full-fledged production version we will include this code in the free demo version.
_M | -----Original Message----- | From: [EMAIL PROTECTED] | [mailto:[EMAIL PROTECTED]] On Behalf Of R. | Scott Perry | Sent: Wednesday, September 04, 2002 5:07 PM | To: [EMAIL PROTECTED] | Subject: Re: [Declude.JunkMail] Encoded Email... how? | | | | >This one has me baffled. This email (spam) showed up as what | appeared | >to be an html formatted message. When I view the raw message | it appears | >as an encoded attachment making it impossible to filter on any body | >content. | > | >How are they doing it and how do we stop it? | | That's getting to be a more common trick of spammers. They | are sending an | HTML MIME segment that is encoded (using base64 encoding, | which is normally | only used when sending files). That way, the E-mail can't | easily be filtered. | | It's something that we may add a new test for, as HTML (and | text) should | never need to be encoded that way. | -Scott | | --- | [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
