[thelist] Free procmail tip regarding ISO type in subject on spam emails.

Liam Delahunty liam at megaproducts.co.uk
Thu Apr 15 05:12:07 CDT 2004


I was getting confused as to why certain emails were getting through my 
own procmail filters when they clearly contained the banned words.

On looking at the procmail log I saw stuff like the following as a subject.
 
=?ISO-8859-1?b?QnV5IENoZWFwIFNpbGRlbmFmaWwgQ2l0cmF0ZSAuIEludGVybmV0IFNwZWNpYWwh?=

those cleaver spammers are sending the encoded versions of strings as 
the subjects to avoid simple filtering.

<tip type="procmail anti spam filter" author="Liam Delahunty">
Catch encoded messages with a recipe such as the one below in your 
.procmailrc

:0:
* ^Subject:.*\=\?ISO
   mail/spamtest

</tip>

-- 
Kind regards, Liam Delahunty, Mega Products Ltd
12 Bury Place, London WC1A 2JL Fax: +44(0)871 224 7891
http://www.megaproducts.co.uk/ Internet Design & Development


More information about the thelist mailing list