male enhancement emails punching through |
Post Reply ![]() |
Author | |
dcook ![]() Senior Member ![]() ![]() Joined: 31 January 2005 Location: United States Status: Offline Points: 174 |
![]() ![]() ![]() ![]() ![]() Posted: 13 March 2008 at 12:47pm |
Just in the last two weeks I've received a ton of these emails that come right through the filter. I have added keywords where I can, but the content is varied as well as the origination address of the emails. It's a moving target. Have you seen this too? How can I nuke'm?
DC
|
|
Dwight
www.vividmix.com |
|
![]() |
|
WebGuyz ![]() Senior Member ![]() Joined: 09 May 2005 Location: United States Status: Offline Points: 348 |
![]() ![]() ![]() ![]() ![]() |
Have you checked the actual contents of one of the emails. Sometimes they are uuencoded and look like text but when you view them as raw text you see the string of ascii characters.
|
|
http://www.webguyz.net
|
|
![]() |
|
dcook ![]() Senior Member ![]() ![]() Joined: 31 January 2005 Location: United States Status: Offline Points: 174 |
![]() ![]() ![]() ![]() ![]() |
I did discover most of it is from Russia. This may be a stupid question ....How do you see unencoded characters in Outlook?
|
|
Dwight
www.vividmix.com |
|
![]() |
|
WebGuyz ![]() Senior Member ![]() Joined: 09 May 2005 Location: United States Status: Offline Points: 348 |
![]() ![]() ![]() ![]() ![]() |
You would have to look at the raw text of the email. Outlook automatically does the translation. What you see in your mail preview is the decoded text. I was doing the same thing you were, kept adding keywords that I saw in the emails customers forwarded to me. Finally got one myself and looked at the raw text and saw the uuencoding. In my case we use Spam Assassin filter after SFE so I just upped scoring for that test until it failed every time. Explaination I found below is pretty good. These russian spammers are uuencoding text (not binary which uuencoding was designed for) to get around the keyword checking in spam filters:
The Why behind UUencoding and Other Schemes Some Internet protocols were not designed to carry binary (program and other non-text files) files. They are only able to transfer messages made up of conventional text (printable ASCII) characters. In order to get around that limitation, UUencode and other methods were created. These solutions all perform the same basic operation: they encode the non-transferable binary file into ASCII characters that the e-mail system can handle. The person receiving the message can then decode the strings of characters to recreate the original file. Perhaps you have seen one of these apparently unintelligible messages; here's an example: begin 666 encoded.txt |
|
http://www.webguyz.net
|
|
![]() |
|
dcook ![]() Senior Member ![]() ![]() Joined: 31 January 2005 Location: United States Status: Offline Points: 174 |
![]() ![]() ![]() ![]() ![]() |
How about filtering on uuencoded emails. Has anyone had success with that? Is Legit email uuencoded? What regex code should I use?
|
|
Dwight
www.vividmix.com |
|
![]() |
|
dcook ![]() Senior Member ![]() ![]() Joined: 31 January 2005 Location: United States Status: Offline Points: 174 |
![]() ![]() ![]() ![]() ![]() |
I found the solution, it's a legacy .ini setting:
FilterBase64html=1
That reduced these junk emails to a trickle.
|
|
Dwight
www.vividmix.com |
|
![]() |
|
jerbo128 ![]() Senior Member ![]() ![]() Joined: 06 March 2006 Status: Offline Points: 178 |
![]() ![]() ![]() ![]() ![]() |
;Set FilterBase64html to 1 if you want to block any emails with Content-Transfer-Encoding=base64 and Content-Type=text/html or text/plain
FilterBase64html=0 I guess the part that scares me here is the text/html and text/plain.
Can someone explain this setting a bit more?
Jeremy
|
|
![]() |
|
Desperado ![]() Senior Member ![]() ![]() Joined: 27 January 2005 Location: United States Status: Offline Points: 1143 |
![]() ![]() ![]() ![]() ![]() |
Encoding=base64 and Content-Type=text/html or text/plain are mutually exclusive. Content type can not be (or should not be) text AND base64 encoded. Base64 encoding is the encoding used for images (gif, etc). So if a header is claiming to be both plain text and encoded ... something is fishy.
Edited by Desperado - 18 March 2008 at 11:29am |
|
The Desperado
Dan Seligmann. Work: http://www.mags.net Personal: http://www.desperado.com |
|
![]() |
|
dcook ![]() Senior Member ![]() ![]() Joined: 31 January 2005 Location: United States Status: Offline Points: 174 |
![]() ![]() ![]() ![]() ![]() |
So, what settings do you use to block that fishy combination?
|
|
Dwight
www.vividmix.com |
|
![]() |
|
Desperado ![]() Senior Member ![]() ![]() Joined: 27 January 2005 Location: United States Status: Offline Points: 1143 |
![]() ![]() ![]() ![]() ![]() |
FilterBase64html=1
|
|
The Desperado
Dan Seligmann. Work: http://www.mags.net Personal: http://www.desperado.com |
|
![]() |
|
Thermo ![]() Newbie ![]() Joined: 10 July 2006 Location: Canada Status: Offline Points: 25 |
![]() ![]() ![]() ![]() ![]() |
I had to set my filter back to the default FilterBase64html=0 because it was blocking BlackBerry emails because they are base64 encoded. I don't want to whitelist all of RIM's servers how do you handle emails from BlackBerrys?
|
|
![]() |
Post Reply ![]() |
|
Tweet
|
Forum Jump | Forum Permissions ![]() You cannot post new topics in this forum You cannot reply to topics in this forum You cannot delete your posts in this forum You cannot edit your posts in this forum You cannot create polls in this forum You cannot vote in polls in this forum |
This page was generated in 0.176 seconds.