Am Donnerstag, 24. Februar 2005 19:12 schrieb Matt Kettler: > At 05:42 AM 2/24/2005, Thomas Arend wrote: > >I got lots of messages with subjects of the form: > > > >Subject: =3D?utf-8?q?Wholesale Rolex Watc?=3D > > =3D?utf-8?q?hes?=3D > > > >Also mail Addresses use this type of obfuscation. > > > >My Question: How are thes character set changes handled by SpamAssassin > >rules and bayesian filtering. > > Normal rules and bayes see them after they've been decoded. So as far as > 90% of SA is concerned, the character set changes aren't there. > > Rules that specifically want to detect this stuff can do so by using the > > :raw modifier.. i.e.: > > header LOCAL_ENCSUBJECT Subject:raw =~ /\=\?.*\?\=/i > > Matches subject lines like: > > Subject: =?iso-8859-8?Q?=F2=EC_=E7=EB=EE=FA_=E4=E9=EC=E3?=
When I understand you right my rolex rule is spoiled by this trick. Because header LOCAL_ENCSUBJECT Subject: =~ /rolex/i will not fire on these subjects. Thomas -- icq:133073900 http://www.t-arend.de
pgp6EiCkKHslY.pgp
Description: PGP signature
