Except for the underscore I inserted, both snippets are verbatim. No trailing spaces or hidden control characters. The message was not in Base-64. I just checked my Declude log for today and it did fire off on 7 other messages today.
I'll include the whole spam message in an attachment here. Andrew 8) -----Original Message----- From: R. Scott Perry [mailto:[EMAIL PROTECTED]] Sent: Tuesday, January 07, 2003 6:05 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] A line in one of my filter text files didn 't fire 't fire >BODY 0 CONTAINS bta_mail.net.cn > ><FONT >face=verdana color=#800000 size=3><STRONG>Unsubscribe >at: [EMAIL PROTECTED]</STRONG></FONT> >******</BODY></HTML> That should get caught. Does the "BODY 0 CONTAINS bta_mail.net.cn" line contain any spaces/tabs at the end of it? Could the E-mail that was caught have been sent using base64 encoding perhaps? -Scott
SpamSample.zip
Description: Binary data
