[SAtalk] Broken base64 / HTML?

[Evan Platt]

Hello all.. I hope these types of questions are allowed here.. I'm an end user but work for an ISP (I'm in tech support, not engineering.. yet. <grin>)

We're running version 2.43 of spam assassin. And ever since our install (may have been 2.41? Not sure, can find out if need be). But I get a fair number of SPAMS (I think a few non-spams too, but I'd have to double check) that have essentially broken base64. So its not a big issue because a majority of it is spam, but it sort of hinders me doing filtering on my pop server (I run mdaemon). It would be nice to be able to see the below spam, so I know if its' saying something common that I can filter on, i.e. "This message was sent on behalf of SPAMSITE.COM....". Below is an example of one such message. Yup, that's the entire message.

Any help appreciated. And if this isn't a list for me (i.e. for developers only), let me know. I'll probably lurk a while, post every once in a while....

Thanks. :)

Evan


X-Spam-Level: *******
X-Spam-Checker-Version: SpamAssassin 2.42 (1.115.2.14-2002-10-04-exp)
X-Spam-Prev-Content-Type: multipart/mixed;boundary= "----=_NextPart_000_005A_3C9FA73E.4AC881BF"
X-Spam-Report: 7.30 hits, 5 required;
* 1.3 -- From: does not include a real name
* 0.2 -- X-Mailer header indicates a non-spam MUA (Outlook Express)
* 1.4 -- BODY: Spam phrases score is 08 to 13 (medium)
[score: 9]
* 0.0 -- BODY: Contains a line >=199 characters long
* 1.4 -- RAW: Message text disguised using base-64 encoding
* 0.8 -- RBL: Received via a relay in multihop.dsbl.org
[RBL check: found 185.175.226.209.multihop.dsbl.org]
* 0.4 -- RBL: Received via a relay in relays.osirusoft.com
[RBL check: found 55.116.226.209.relays.osirusoft.com., type: 127.0.0.3]
* 0.8 -- RBL: Received via a relay in unconfirmed.dsbl.org
[RBL check: found 185.175.226.209.unconfirmed.dsbl.org]
* 0.6 -- RBL: DNSBL: sender ip address in in a dialup block
* 0.4 -- RBL: Received from first hop dialup listed in relays.osirusoft.com
[RBL check: found 55.116.226.209.relays.osirusoft.com., type: 127.0.0.3]




------=_NextPart_000_005A_3C9FA73E.4AC881BF
Content-Type: text/plain
Content-Transfer-Encoding: base64
SSBub3RpY2VkIHRoYXQgeW91IGRpZG4ndCBoYXZlIGEgbG93IGNvc3QgODAwIG51bWJlciBv
biB5b3VyIHdlYnNpdGUuIFdlIGhhdmUgZm91bmQgYSBjb21wYW55IHRoYXQgY2FuIHByb3Zp
ZGUgVG9sbCBmcmVlIGNhbGxpbmcgdG8geW91ciBwcm9zcGVjdGl2ZSBjdXN0b21lcnMgd2l0
aCBubyBjb250cmFjdHMgdG8gc2lnbiBhbmQgbm8gc3BlY2lhbCBlcXVpcG1lbnQgbmVlZGVk
LiBBbGwgeW91IGhhdmUgdG8gZG8gaXMgcGljayBvbmUgb2YgeW91ciBleGlzdGluZyBudW1i
ZXJzIGFuZCB0aGV5IHdpbGwgZm9yd2FyZCB0aGUgY2FsbCB0byB5b3UgYW5kIHRoZSBuZXcg
Y3VzdG9tZXIgd2lsbCBuZXZlciBrbm93ISEgQWxsIHlvdSBwYXkgaXMgNi45IGNlbnRzIHBl
ciBtaW51dGUgYW5kIG5vIG90aGVyIGNvc3RzISEgIA0KDQpDaGVjayBvdXQgdGhlaXIgbG9u
ZyBkaXN0YW5jZSByYXRlcy4gIDYuOSBjZW50cyBwZXIgbWludXRlIG9uIHN0YXRlLXRvLXN0
YXRlIGNhbGxpbmcgd2l0aCBhIGxvdyBpbi1zdGF0ZSBsb25nIGRpc3RhbmNlIHJhdGUuIA0K
DQpKdXN0IGdvIHRvIGh0dHA6Ly93d3cuc2VvaGVscDEwMS5jb20vd2xkIGFuZCBsb29rIGZv
ciB0aGUgV2ViIExvbmcgRGlzdGFuY2Ugd2Vic2l0ZSB0byBnZXQgc3RhcnRlZCEhISENCg0K
RnVydGhlciBlbWFpbGluZyB0byB5b3UgYnkgdGhlIHNlbmRlciBvZiB0aGlzIGVtYWlsIG1h
eSBiZSBzdG9wcGVkIGJ5IGNvbnRhY3RpbmcgYXVnbWVudGhpdHNfcmVtQGhvdG1haWwuY29t
IHdpdGggIldpdGhkcmF3IiB0eXBlZCBpbnRvIHRoZSBzdWJqZWN0IGxpbmUuDQogICAg
------=_NextPart_000_005A_3C9FA73E.4AC881BF--




-------------------------------------------------------
This sf.net email is sponsored by: viaVerio will pay you up to
$1,000 for every account that you consolidate with us.
http://ad.doubleclick.net/clk;4749864;7604308;v?
http://www.viaverio.com/consolidator/osdn.cfm
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk