I use spamcop's reporting service to report spam. Recently a debate arose regarding Base64 encoded spam. Many people munge out personally identifying information from spam before reporting because they do not want the spam sender to know who reported them. With Base64 encoded spam, this was not possible to do for many people without manually decoding the Base64 encoded message. Several of us are "lucky" enough to not have to do this manually, because our email clients do it for us automagically. The debate was sparked when someone asked if this decoding and further munging was a "material change" to the email. (The importance of which is that it is against spamcop's rules to make any "material changes" to the email.) The debate was settled by the following modification to spamcop's rules: Base64 Encoded Spam - Many spammers are sending messages with Base64 encoded bodies. While SpamCop normally decodes and parses Base64 fine, it is possible for spammers to hide your address or other identifiable information within the encoded body.
For this reason, SpamCop has made an exception to the normal alteration rule for those who know what they are doing: 1.. Use a Base64 decoding tool like http://www.wc.cc.va.us/dtod/base64/ 2.. Remove the encoded Base64 body and replace it with the decoded text 3.. A disclaimer must be added to the top of the spam body. (Remember to leave a blank line between the last header line and your disclaimer): "I have decoded the original Base64 spam body and munged personal details that were in that body. The original body has been replaced with this decoded text. I understand that you may consider this to be altered and not acceptable as evidence" Because of this, I must find a way of determining which spam that comes into emailer was Base64 encoded, before I can report it without breaking spamcop's rules. Is there a header I can filter on to determine when there was Base64 or not? -- -David ___________________________________________________________________________ To unsubscribe send a mail message with a SUBJECT line of "unsubscribe" to <[EMAIL PROTECTED]> or <[EMAIL PROTECTED]>
