Hi - I previously mentioned that I was getting emails with hand created html tags, that had both uppercase and lowercase letters.
I created a crude rawbody rule to test for them. It worked, until the spammer accidentally added the line "Content-Transfer-Encoding: base64", even though the body of the message is not encoded with base64. Because of this, my rawbody rules failed to trigger. See below. Is there a way to detect a malformed email like this? Also, can anyone suggest a nicely written rule, that triggers when an html tag's text contains both upper and lower case letters? Thanks. - Mark MIME-Version: 1.0 From: c...@nmlc.com To: markrlon...@gmail.com Date: Sun, 31 Dec 2017 18:42:25 CET Subject: Never Pay For Covered Home Repairs Again-Best deal of the year, Iimited-Time*Njvt Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: base64 Message-ID: <NTMHDCrauhrQ5zjWNWEB20SB8wSA1X00000533@NTMHDCWEB20SB> X-OriginalArrivalTime: 22 Mar 2017 15:52:46.0402 (UTC) FILETIME= X-SG-EID: Ir4EYmZz10i7MgunveLJlw0xcvqQbeauQMDQs3EPe27heIGiqko5Ui6DR17zgRAkuOys70ubB2uU06 2rXoYm1NiUd72Cmr8IRCp81sAgopwU26YxZSasTrSlTtZfLgs+yn3P85pGOBbZrAEV2KAPssmDkJ77 YTcMSxfLqx2qEBkTLe9yUFrjCwDKa+CySPgoWXhA3BKLnvIvUPwEgt0uMQ== X-Feedback-ID: 561562:WZ3ZRcIWAujB4xGDqDKA1Ud8w67Bpa8gtW18sDbAXo0=:WZ3ZRcIWAujB4xGDqDKA1Ud8w67Bpa8gtW18sDbAXo0=:SG <cenTeR><A HrEf=http://www.sitedesk.net/redirect.php?url=http%3A%2F/%2f/ec2-52-52-247-130.us-west-1.compute.amazonaws.com/qs=r-aeideaebigkjffgafifgifajjibbeaeekabababadjadaccaebbacdckacckcacb><IMg srC=https://www.imagevita.org/uploads/46174adfa726bcdadfc2914890c02ee9.jpg></a><HeAD><br><A HrEf=http://www.sitedesk.net/redirect.php?url=http%3A%2F/%2f/ec2-52-52-247-130.us-west-1.compute.amazonaws.com/qs=ua-aeideaebigkjffgafifgifajjibbeaeekabababadjadaccaebbacdckacckcacb><IMg srC=https://www.imagevita.org/uploads/8d36198d9d812471230cd3a1362eb169.jpg></a><br><A HrEf=http://www.sitedesk.net/redirect.php?url=http%3A%2F/%2f/ec2-52-52-247-130.us-west-1.compute.amazonaws.com/qs=u-aeideaebigkjffgafifgifajjibbeaeekabababadjadaccaebbacdckacckcacb><IMg srC=https://www.imagevita.org/uploads/529ec935ba2f0b52917be25826b3a23b.jpg></a><br><hr><Div style="height:5500PX"></div>The New York Times Thank you for registering.
