> -----Original Message----- > From: Mike Kuentz (2) [mailto:[EMAIL PROTECTED] > Sent: Tuesday, September 09, 2003 3:04 PM > To: [EMAIL PROTECTED] > Subject: [SAtalk] [RD] Subject rule question > > > I see a lot of spams coming through hiding the subject masked using > ISO-8859, like this > > Subject: =?ISO-8859-1?b?SGFsZiBQcmljZWQgU2lsZGVuYWZpbCBDaXRyYXRl?= > > which translates back to a subject of: > > Half Priced Sildenafil Citrate > > obviously I can look for "Half Priced Sildenafil Citrate" in > the subject, > but I want to write a rule for ISO-8859 in the subject. I > have this rule, > but it doesn't appear to hit. > > header MK_CHARSET_IN_SUBJECT Subject =~ /ISO\-8859/i > > Does SA translate that before hand and that's why it's not > hitting? It's > obviously a big thing for spammers, since a search on > groups.google.com for > ISO-8859 turns up tons of results from news.admin.net-abuse.sightings. > > Mike > >
I noticed the same last week and my rule didn't hit either. I was going to try a rawbody or raw rule next. Try that. I didn't get to it because the spam was already caught. Went down on the priority list :-) Chris Santerre System Admin and SA Custom Rules Emporium keeper http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm "A little nonsense now and then, is relished by the wisest men." - Willy Wonka --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.516 / Virus Database: 313 - Release Date: 9/1/03 ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
