Not sure if I just never noticed before, or if these spammers are using a new technique.

I'm seeing text messages (they look like text) but when you view the source the messages are just base64 encoded.  Guess the email client is decoding the source.

Am I correct in that spamfilter can not do keyword scanning on messages that are base64 encoded?

Hi Roberto,

I have been spending some time since posting that query trying to stop these messages.

I would have to ask are you sure it does not decode base64 messages?

The reason I say this is I'm looking at a message right now, it was placed in quarantine rejection reason 13 - and it shows the keywords that triggered it.

When I look at the message source from the quarantine table it has a text/plain & text/html sections (and an image/jpeg section) all of them are base64 encoded.

If I decode the base64 message content the keyword filter that triggered it does in fact exist in the message.

So in this case at least spamfilter must have decoded the message before running the keyword filters...

I will email you a copy of the message for your reference.