Scott, if you're so inclined, I've found another "BS" test for your code to
check, i.e. does the encoding actually match what the header says.
I received a piece of spam this morning, and was really surprised, because I
*knew* I had added the URL to one of my filter text files, and this e-mail
used no obfuscation techniques to mess up the text match.
So I went digging into the Declude log and found that quite a few people had
been BCC'ed to get the message, and that several tests had "hit" but the
score wasn't quite high enough to be held. And right after it was another
message that had been held, because that one had matched the filter text for
the URL. Now it was more than annoying, it was a puzzle!
The second message was an undeliverable bounce message that was outbound.
<ding>
So I went back and looked at the header of the original message, assuming
that some trick had been pulled, such that my "BODY" filter didn't work on
the inbound message, but my mail server cleaned it up on the outbound, where
it was subsequently filtered correctly. Bingo.
The header of the message says that the body encoding is base64, but it was
**actually** just plain ascii text.
For what it's worth, I'll paste in here the message, with the URL mangled
with underscores.
Andrew 8)
Received: from mail.bentall.com (BT4MAILRELAY1 [10.192.99.216]) by
bt4exch1.bentall.com with SMTP (Microsoft Exchange Internet Mail Service
Version 5.5.2653.13)
id FCDRH6T0; Mon, 10 Mar 2003 02:22:22 -0800
Received: from vsnl.net.in [68.153.216.50] by mail.bentall.com
(SMTPD32-7.13) id A757D8C00CC; Mon, 10 Mar 2003 02:22:15 -0800
Message-ID: <[EMAIL PROTECTED]>
From: <[EMAIL PROTECTED]>
To: bigger
Subject: Men gain size where it counts 2231FppU1-02-11
Date: Mon, 10 Mar 2003 04:22:36 +0600
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.00.2919.6700
Content-Transfer-Encoding: base64
Be the guy the girls tell there friends about!
http://www.be_efu_py_ourp_eni_s_.com/main2.php?rx=15331
If you could gain size in your penis by simply taking a pill
would you do it?
http://www.be_efu_py_ourp_eni_s_.com/main2.php?rx=15331
This is not a gimmick!
Please just take a moment and look at the site.
http://www.be_efu_py_ourp_eni_s_.com/main2.php?rx=15331
Thank you for your time!
9121uhOo7-808vtZA5685lUdF6-955isZe3066KjYw5-289eMGM0675JPl54
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
