Apparently, this means "Generic Viagra" as revealed in the Declude Log file:
=?iso-8859-1?B?R2VuZXJpYyBWaWFncmE=?=
What can you do about obfuscated subjects using ISO character sets? I was thinking of filtering them based on partial string, like this:
SUBJECT 30 CONTAINS =?iso-8859
Is it safe to filter this? In other words, would a legitimate or casual sender ever use such a method to display a subject? Is there a list of ISO charcter sets that can be filtered?
That's the "Plain English" character set, so it should be safe to filter on (since plain English should be in... well, just that -- plain English!). The NONENGLISH test doesn't check for iso-8859-1, but does check for some others that aren't English.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection.
Find out what you have been missing: Ask for a free 30-day evaluation.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
