Jari Fredriksson kirjoitti 18.3.2016 18:56:
Joseph Brennan kirjoitti 18.3.2016 18:48:
Today's version has a Subject of this form:
FW: Notification from WORD WORD
...where WORD WORD varies per message but is always all caps. The
three Content-Type lines Chip mentioned are the same, and they are the
only ones that should be used for rtf. The name is similar, repeating
the same variable as in the Subject, for example:
Content-Type: application/octet-stream;
name="Invoice_ZLINV54216_from_WORD WORD.rtf"
There is a space in the file name. The variable ZL string is not in
the Subject today. I don't have a full sample, just what we've logged,
so I can't say whether the unusual X- headers continue.
Spamhaus knows most of the hosts they are sending from.
Joseph Brennan
Columbia University Information Technology
I have received today:
Content-Type: application/octet-stream;
name="Invoice_TGINV54153_from_tip_top_delivery.rtf"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="Invoice_TGINV54153_from_tip_top_delivery.rtf"
The Subject is also an "Invoice TGINV... from tip top", not
"Notification..." so these may be variants of what you got.
Which is to say that got the same as the OP reported.
--
jarif.bit
