On Tue, 6 Oct 2009, Ralf Hildebrandt wrote:
I want to examine delivered messages that contain
"Content-Transfer-Encoding: base64" in the header.
Basically that would be all messages...
Ralf,
I asked locally about that because much of the spam I receive is coded
base64 while almost all other traffic is either encoded 7bits or doesn't
have a Content-Transfer-Encoding specification in the header.
What exactly is it that you want to do. In real life almost ALL mails are
base64 encoded...
I want to explore the possibility of using this to identify spam that is
obfuscated and passes the other postfix UCE filters. There are some
persistent spammers with the same text string in the body of the message
that I can initially catch with a body_checks filter. But, soon the messages
make it into my inbox despite that phrase being in the body_checks. Looking
at the headers of these I see the "Content-Transfer-Encoding: base64" line,
and I don't see it in other messages in my inbox. I think that alpine
automatically decodes them after postfix hands them off to procmail so the
UCE filters stop working.
Rich
