Hi all,
lately i see more and more mails using base64 encoding for the body of
the mails.
example:
-------------------
Date: Thu, 05 Apr 2018 16:22:08 +0200
From: ca...@blaha.net
Subject: Marth
X-Originating-IP: 179.96.142.37
X-Sender: ca...@blaha.net
To: xxx...@xxxxxx.com
Message-id: <90905a3b-40dd-a2b1-94cb-2af3ff398...@blaha.net>
MIME-version: 1.0 (1.0)
X-Mailer: iPad Mail (13E238)
Content-type: text/plain; charset=UTF-8
Content-transfer-encoding: base64
X-Greylist: Sender IP whitelisted by DNSRBL,
not delayed by milter-greylist-4.5.11 (xxxxxxxxx
[X.X.X.X]); Thu, 05 Apr 2018 16:22:12 +0200 (CEST)
X-Scanned-By: MIMEDefang 2.79
Original-recipient: rfc822;xxxxx...@xxxxxxxx.fr
QXJlIHlvdSByZWFkeSB0byBoYXZlIGluc2FuZSBzZXggd2l0aCBtZT8NCknigJltIHJlYWR5IHRv
IHNoYXJlIHNvbWUgb2YgbXkgaG90IHNleHkgcGhvdG9zLg0KQWZ0ZXIgd2F0Y2hpbmcgbXkgYnV0
dG9ja3MsIGJyZWFzdHMsIGFuZCBsb25nIGxlZ3MgeW91IHdpbGwgbm90IHJlbWFpbiB1bnNhdGlz
ZmllZC4NCkNvbnRhY3QgbWUgYW5kIEkgY2FuIGdpdmUgeW91IG15IGxvY2F0aW9uLg0KDQpodHRw
Oi8vd3d3LmFzdHJlaW50ZS1kZXBhbm5hZ2UuY29tLzF4ZTNjOGIzdy9na25wZHEyZ3cucGhwP1pY
WmxiR2x1WlM1c2RYQnBZV05BWVdNdGJXOXVkSEJsYkd4cFpYSXVabkk9DQo=
------------------------------------
This is a spam mail, my SpamAssassin did not recognize it as spam, even
if i have rules that can match the decoded body. My question is:
Is it possible to decode into TXT/HTML the encoded parts so SA can catch
it ? Otherwise, how can the rule be applied to an encoded mail body?
Regards.
Signature Academique
