Re: Funky HARP Spam

2014-07-01 Thread Philip Prindeville
On Jun 27, 2014, at 12:34 PM, Philip Prindeville wrote: > > On Jun 27, 2014, at 7:30 AM, RW wrote: > >> >> As I mentioned before, the real violation is in the previous mime >> section, which claims 7bit, but contains octets with the high-bit set. > > > Yup. Just submitted a patch for th

Re: Funky HARP Spam

2014-06-27 Thread Philip Prindeville
On Jun 27, 2014, at 7:30 AM, RW wrote: > > As I mentioned before, the real violation is in the previous mime > section, which claims 7bit, but contains octets with the high-bit set. Yup. Just submitted a patch for this: https://issues.apache.org/SpamAssassin/show_bug.cgi?id=7063

Re: Funky HARP Spam

2014-06-27 Thread RW
On Thu, 26 Jun 2014 19:02:42 -0600 Philip Prindeville wrote: > > Since Ь is outside the US-ASCII character set, this would be an > encoding violation. It's not. In HTML Ь is an ASCII representation of a unicode character. It represents a character within HTML, but as far as mime is concerned i

Re: Funky HARP Spam

2014-06-26 Thread Philip Prindeville
On Jun 26, 2014, at 7:02 PM, Philip Prindeville wrote: > > On Jun 25, 2014, at 5:29 PM, RW wrote: > >> On Wed, 25 Jun 2014 14:21:33 -0600 >> Philip Prindeville wrote: >> >> >>> Here’s the other thing I don’t get. >>> >>> The message claims to be 7-bit and text/plain, yet it uses encoded >

Re: Funky HARP Spam

2014-06-26 Thread Philip Prindeville
On Jun 25, 2014, at 5:29 PM, RW wrote: > On Wed, 25 Jun 2014 14:21:33 -0600 > Philip Prindeville wrote: > > >> Here’s the other thing I don’t get. >> >> The message claims to be 7-bit and text/plain, yet it uses encoded >> characters which exceed 7-bit widths yet this doesn’t seem to be >> fi

Re: Funky HARP Spam

2014-06-25 Thread RW
On Wed, 25 Jun 2014 14:21:33 -0600 Philip Prindeville wrote: > Here’s the other thing I don’t get. > > The message claims to be 7-bit and text/plain, yet it uses encoded > characters which exceed 7-bit widths yet this doesn’t seem to be > firing any rules either. > > Ь would seem to be at least

Re: Funky HARP Spam

2014-06-25 Thread Richard Doyle
On 06/25/2014 02:12 PM, Philip Prindeville wrote: > On Jun 25, 2014, at 2:58 PM, Axb wrote: > >> On 06/25/2014 10:21 PM, Philip Prindeville wrote: >> >>> http://pastebin.com/qLyKx40b >> "This paste has been removed!" :( > I’ve temporarily posted it on ftp://ftp.redfish-solutions.com/pub/harp.eml I

Re: Funky HARP Spam

2014-06-25 Thread Philip Prindeville
On Jun 25, 2014, at 2:58 PM, Axb wrote: > On 06/25/2014 10:21 PM, Philip Prindeville wrote: > >> http://pastebin.com/qLyKx40b > > "This paste has been removed!" :( I’ve temporarily posted it on ftp://ftp.redfish-solutions.com/pub/harp.eml > >> Here’s what I’m showing it matched: >> >> Jun

Re: Funky HARP Spam

2014-06-25 Thread Axb
On 06/25/2014 10:21 PM, Philip Prindeville wrote: http://pastebin.com/qLyKx40b "This paste has been removed!" :( Here’s what I’m showing it matched: Jun 25 11:16:07 mail mimedefang.pl[18682]: s5PHFqsC019802: s5PHFqsC019802: 4.889 () BAYES_00,BODY_8BITS,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_

Re: Funky HARP Spam

2014-06-25 Thread Philip Prindeville
And on a totally unrelated note, is there any way enforce a rule to only be true if it applies for an individual MIME body part? For instance, I might test for a mimeheader of Content-Transfer-Encoding being “7bit”, but also having seen BODY_8BITS… but I need them to both be true in an individu

Funky HARP Spam

2014-06-25 Thread Philip Prindeville
I was surprised that my SPAM filters didn’t find this. Not sure what code page it’s using… whatever 0x04xx is in… what? Is this UTF-8? There’s no explicit charset given. Also, I noticed that a lot of these types of SPAMs have ‘b’ replaced by cyrillic soft sound, i.e. the word “about” is writte