Re: check utf-8 subjects/from?

2017-12-14 Thread John Hardin
On Wed, 13 Dec 2017, Alex wrote: We've been seeing a number of emails with subjects using UTF-8 in an attempt to obscure the sender by using some form of 8-bit characters. For example, this spells dropbox: From: "=?utf-8?B?xJByb3Bib8+X?=" How would we write a header rule against that? Just u

Re: check utf-8 subjects/from?

2017-12-14 Thread AJ Weber
On 12/13/2017 6:58 PM, Reindl Harald wrote: > There seems to be a large disparity between your (10%) result and my > (2%) result.  Can you explain how that could be? surely, from the moment you have not only english messages it looks completly different and don't forget that the corpus where i

Re: check utf-8 subjects/from?

2017-12-14 Thread hamann . w
>> Hi, >> >> On Wed, Dec 13, 2017 at 9:08 PM, David B Funk >> wrote: >> > On Wed, 13 Dec 2017, AJ Weber wrote: >> > >> >> Is there an easy way to check if the Subject or From is UTF-8 -- or >> >> non-ASCII -- char set? >> >> >> >> I see in some of my recent spam, either the Subject or the From (s

Re: Mailsploit

2017-12-14 Thread Kevin A. McGrail
On 12/13/2017 5:24 PM, sha...@shanew.net wrote: Note that after enabling KAM.cf, you'll want to watch more closely for false positives and possibly adjust scores as necessary.  I think it's a great addition to the default rules, but it's primarily tuned to Kevin's environment (though he's open to