RE: [Declude.JunkMail] V_IAGRA won't die

[Markus Gufler]

Title: Nachricht

Mike,

 

Most messages processed by our server are written in european languages. (German, Italian, French, ...) We see a lot of this ISO-.... subject lines.

 

This is a base64 encoded subject line. (the "?B" after the ISO-id means base64-encoded)

SpamChk can identify suspicious keywords that are encoded like this.

 

BTW: Even if some subscribers of this lists has whitelisted anyway messages from this list, it's not a good idea to put such a keyword in the subject. I bet not all subscribers has recieved your message.

 

Markus

 

 

-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mike Gable
Sent: Tuesday, June 24, 2003 7:21 PM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] VIAGRA won't die

Apparently, this means "Generic Viagra" as revealed in the Declude Log file:

 

 =?iso-8859-1?B?R2VuZXJpYyBWaWFncmE=?=

 

What can you do about obfuscated subjects using ISO character sets? I was thinking of filtering them based on partial string, like this:

 

SUBJECT 30 CONTAINS =?iso-8859

 

Is it safe to filter this? In other words, would a legitimate or casual sender ever use such a method to display a subject? Is there a list of ISO charcter sets that can be filtered?

 

Thanks!

 

Mike