Dear Entourage:mac Talk,
> From: "Peter C.S. Adams" <[EMAIL PROTECTED]>
> Date: Mon, 06 Jan 2003 12:37:47 -0500
> Subject: Re: A Question about Rules and Crashing...
>
> Lately I've been seeing spam that passes through all my criteria and has an
> odd characteristic: looking at the source, you see that the body of the
> message is Base 64 encoded HTML! Apparently, Entourage decodes the Base 64
> and displays it. So I have devised a new rule with the following three
> tests. If all three are met, the message is flagged. (Once I'm happy with
> the results, I'll change the rule to delete the messages unseen.)
>
> 1. Attachment does not exist.
> 2. Any header contains "text/html"
> 3. Any header contains "base64"
>
> I am assuming that no legitimate message will ever contain Base 64 encoded
> HTML (why should it?) and that any legitimate Base 64 would be in an
> attachment (so in theory I could do away with test #2).
This rule works really well and made hits on 73 spams in my 5900 spam test
set and failed to find any legit out of 300 odd in my in tray. But more
importantly it found 7 more spams in the 102 that I had not been able to
detect so far.
Unfortunately it seems to miss very similar styled emails that have this
text/html + base64 combo in part 2 of a multipart message which is not
identified by entourage (2001) as having attachments. There seems to be no
way of getting into that second part and finding these ones other than going
down the script path.
Cheers
Bob J.
--
Bob Jordan Macintosh
BioEngineering Technologies The Platform of Choice
Phone +64 7 858 4748 Simple
Fax +64 7 858 4705
HortResearch, Private Bag 3123, Hamilton, New Zealand
______________________________________________________
The contents of this e-mail are privileged and/or confidential to the
named recipient and are not to be used by any other person and/or
organisation. If you have received this e-mail in error, please notify
the sender and delete all material pertaining to this e-mail.
______________________________________________________
--
To unsubscribe:
<mailto:[EMAIL PROTECTED]>
archives:
<http://www.mail-archive.com/entourage-talk%40lists.letterrip.com/>
old-archive:
<http://www.mail-archive.com/entourage-talk%40lists.boingo.com/>
