----- Original Message ----- From: "Kris Deugau" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, July 20, 2004 4:50 PM Subject: Re: FBI info Spams
> Obantec Support wrote: > > From: =?Windows-1251?B?aW5mb0BhdnZlc3RhLmNvbQ==?= <[EMAIL PROTECTED]> > > Subject: =?Windows-1251?B?V2hhdCBEbyBUaGV5IEtub3cgQWJvdXQgWW91Pw==?= > > > > Does 2.63 or even 3.0 stop these? > > Dunno for sure; but I can't say I've seen any of these reported as FNs > by customers in a long time, and I can't say I've seen it used much in > legit mail recently. I added a few rules to SA to increase the score a > little on these, but I scored them low because they caused a few FPs. > > At one point, I added some procmail rules for similar encodings > (Japanese/Korean/Chinese and similar) on my personal account rather than > spend the processing power to run SA on a message I can't read anyway. > > They still catch ~ 1/2 of the spam coming in to that account. :/ I > seem to have been added to a number of Asian mailing lists by spammers. > > (Every so often I poke through them and click on a URL just for the > general hell of it. Occasionally I even find a site with some English > text. <g>) > > -kgd > -- > Get your mouse off of there! You don't know where that email has been! > Hi Kris these e-mail's are html and in english. The From: in OE says minus the "" "[EMAIL PROTECTED]" the Subject read as (minus the "") "What Do They Know About You?" It would appear that the ?Windows-1251... is encoding that OE displays as plain text. the url is in plain text in the body so i guess i could do a regrexp on the body for http://www.avvesta.com/ Had 2 today which is 2 too many. Mark
