[EMAIL PROTECTED] wrote:
Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: base64
Probably a message in base64 that does not contain any single 8bit code should be considered as an attempt to hide the message from scanners
That's a good idea, Wolfgang. The message I posted said it was in ascii. I've not delved into writing SA rules that combine different message features, but this sounds like a possibility. If base64-only with a 7bit charset, then score it.
I'll put it on my todo list; maybe I'll come up with something before the new year!
Peter
