Hi! I just found a perfectly legitimate E-Mail which neighter contained Spam-Text nor any html in my Spambox, hit by two 'ofsucation checks'.
One I had generated with https://sandgnat.com/cmos/cmos.jsp in response to the ever increasing use of the Word 'curn', the other checks for 'too long or short html-tags'. The exact 'strings-in-the-mail' seem to be hard to find, but the real *problem* is: Somebody (correctly) Attaches a *complete* RFC-conforming Mail (including Headers) to a nearly empty Mail of 'his own'. So we get a mail structured like this (mutt display de-personified): I 1 <no description> [text/plain, 7bit, iso-8859-1, 0K] I 2 ... the new subject ... [message/rfc822, 8bit, 167K] I 3 `-><no description> [multipa/mixed, 7bit, 165K] I 4 |-><no description> [text/plain, 8bit, iso-8859-1, 1.3K] A 5 |->... title of (win*)word attachment ... [applica/msword, base64, A 6 `->... pdf-filename ... [applica/pdf, base64, 129K] THE HEADERS IN PART 4 (included via part 3) of course contain 'addresses' of the attachted mail, so we get some things like: Adresses: From: <[EMAIL PROTECTED]> Message IDs in various Formats (e.g.): Message-ID: <[EMAIL PROTECTED]> Received-Headers in arbitrary formats (e.g.): Received: by hhhh.ddddd.ddddddddd.de (Exim 4.24) from [###.##.###.###] (helo=NNNNNNNN) for [EMAIL PROTECTED] with smtp id <1AQkrK-024j2F-DC>; Mon, 01 Dec 2003 11:00:50 +0100 As theese '...<whatever_lookr_like_html_tag>...'-'Adresses/IDs' are the ONLY pairs of '<>', they must have been the trigger for the HTML rule, and I *assume* that somewhere in in the base64-code will be the 'seemingly ofuscated p*rn-word ... Any chance to fix such an effect without completely disabling the rules? Stucki ------------------------------------------------------- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
