We've had a few, but we didn't keep them around. There are some folks on
the list hunting for examples - I've got an eye out but I'm not trying hard.
Statistically it is a very good test.
The only trouble with not scanning inside base64 segments is that it
reduces your ability to categorize the message... so, for example, if
there's content there that users on your system want to see - but might
otherwise be seen as spam - you will have to work harder to gate that content
through.
This is why Message Sniffer does open base64 segments to look for
patterns.
_M
-----Original Message-----That's what I suspected. Has anyone seen HTML Base64 segments that *weren't* spam? Are there any email clients that actually put out such a thing?
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Scott MacLean
Sent: Wednesday, September 25, 2002 9:31 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Wordfilter in BASE64?
At 08:14 AM 9/25/2002, Madscientist wrote:
Declude does not decode base64, rather it simply detects html base64
segments which are highly likely to be spam.
_M
]-----Original Message-----
]From: [EMAIL PROTECTED]
][mailto:[EMAIL PROTECTED]]On Behalf Of Scott MacLean
]Sent: Wednesday, September 25, 2002 8:10 AM
]To: [EMAIL PROTECTED]
]Subject: [Declude.JunkMail] Wordfilter in BASE64?
]
]
]I just saw an email that *should* have been caught several times over with
]various "BODY CONTAINS" filters, but wasn't - instead, it caught BASE64.
]Does Declude decode the BASE64 body and then apply the wordfilter? Because
]it seems like it might not.
]
]_______________________
]Scott MacLean
][EMAIL PROTECTED]
]ICQ: 9184011
]http://www.nerosoft.com
]
]---
][This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
_______________________
Scott MacLean
[EMAIL PROTECTED]
ICQ: 9184011
http://www.nerosoft.com
