Peter H. Lemieux wrote:
Theo Van Dinter wrote:
On Thu, Oct 26, 2006 at 09:46:28AM -0400, Peter H. Lemieux wrote:
Also is there an SA rule that scores messages that contain only a
single base64 part (as opposed to a base64-encoded attachment)? I
doubt many legitimate messages arrive with only a single base64 part.
No, because there are going to be a lot of mails that would hit that.
Really? Maybe it's because I live in the US, but I can't think of a
legitimate message I've ever received consisting only of a base64 blob.
I'm not sure what to say to that. ;)
Our of curiosity, how frequently does this appear in the SA ham corpus?
Ticketmaster sends out *a lot* of their mail this way. I'm sure it's
partly in an attempt to avoid having their mail FP against crappy filters.
Daryl
