Re: : 9D character used in words to avoid detection

2018-11-18 Thread RW
On Sat, 17 Nov 2018 19:10:57 -0500 Mark London wrote: > --_000_MWHPR14MB13279093501A88B114707EE3B0DD0MWHPR14MB1327namp_ > Content-Type: text/plain; charset="windows-1256" So =9D is a zero-width non-joiner. With normalize_charset this can be detected as the UTF-8 version seen before. > Do=9D

Re: 9D character used in words to avoid detection

2018-11-18 Thread Chip M.
Ditto to what John said, however, thanks for the spample Mark. :) Mark, is that the exact network image? If not, do you have access to it? If so, please pastebin it. By "network image", I mean not-mangled by any post filter software. Your posted spample is quoted-printable, and should have been

Re: Forgery with SPF/DKIM/DMARC

2018-11-18 Thread RW
On Sat, 17 Nov 2018 13:22:55 + David Jones wrote: > 2. Seems like there should be easy rules to detect more than one pair > of angle brackets and more than on at sign to add points to > non-standard display names. The reason I asked about the precise form is that it's not simply a bracketed

semi-OT - reporting an organization that ignores unsubscribe requests

2018-11-18 Thread Joe Acquisto-j4
Gents, I somehow became subscribed to a list, political in nature, in whose mail I have no interest. This is a legitimate AFAIK, US organization. Thus far, several uses of their unsubscribe link had not provided relief. Direct email to the founder and operations manager seem to have been

Re: 9D character used in words to avoid detection

2018-11-18 Thread Bill Cole
On 18 Nov 2018, at 14:30, Chip M. wrote: Mark, is that the exact network image? It cannot have been, as it was missing headers that any message of its apparent lineage (all outlook.com) would have, including Content-Type as you noted as well as MIME-Version and private headers that MS adds

Re: 9D character used in words to avoid detection.

2018-11-18 Thread Pedro David Marco
Kevin,  i think KAM_ZWNJ only triggers with "rawbody".  Actual KAM.cf uses "body"... does the SA body pre-processor removes nulls?? ---PedroD On Saturday, November 17, 2018, 1:41:28 AM GMT+1, Kevin A. McGrail wrote: Yeah, there is a SCC SHORT WORDS rule and a KAM_ZWNJ in KAM.cf.