Re: [Declude.JunkMail] Decoding encoded subject lines

[Matthew Bramble]

Thanks a bunch Markus.  What I will likely do is reduce this to only 
about 70% of my fail weight, figuring that most messages which use one 
obfuscation technique use others which will also produce a score, such 
as Declude's BASE64 test (30% on my system), and on my system, the two 
alone will produce a failure at those scores.  I don't expect to see 
this stuff passing unless it's legit then, and it will help protect from 
FP's.

This is probably good advice for others as well.

Matt



Markus Gufler wrote:

Are you talking about the ?B? or the ?Q?
   

?B?

Some examples from todays logfile:

Subject: Freiberufliche Mitarbeit. Brauchen Sie
=?ISO-8859-1?B?3GJlcnNldHp1bmdlbj8g?=
Subject: Re: Mutige =?iso-8859-1?b?TeRkY2hlbi1TdGFya2U=?= Frauen
=?iso-8859-1?b?SuRubmVy?= Termin
In this cases only the words containing high-bit characters are BASE64
encoded.
Subject: =?ISO-8859-1?B?3A==?=bersetzung Sachsenklemme
Subject: fragen f=?ISO-8859-1?B?/A==?=r advent-gewinnspiel
In this cases only the high-bit characters are BASE64 encoded.

Subject: =?ISO-8859-1?B?Uvxja2xhc3RzY2hyaWZ0IHZvbSAxMS4xMi4yMDAz?=
Subject: =?iso-8859-1?B?aWNoIGJpbnO0cw==?=
In this cases the entire subject line is BASE64 encoded
Both messages was send from web-mailers (Hotmail and GMX) and contain high
bit characters.
For the messages above I haven't any information with what mail clients the
messages was created.
All the messages above are 100% legit.

But this will concern only mailservers that process messages in
international languages using a lot of high-bit characters.
Markus

 



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.