You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Nikolaos Milas <nm...@noa.gr> on 2024/07/18 16:30:50 UTC

Evaluate UTF-8 From / Subject

Hello,

Is there a way we can search for strings in UTF-8 encoded From and/or 
Subject headers?

For example, here is part of a phishing mail header:

...
From: =?utf-8?B?Is6VzpjOnc6ZzprOlyDOpM6hzpHOoM6VzpbOkSI=?=
  <sa...@amtelecom.net>
To: example@example.com
Message-id: <9d...@amtelecom.net>
Date: Thu, 18 Jul 2024 09:40:04 +0200
X-Mailer: Oracle Communications Messenger Express 8.0.2.5.20200127 64bit 
(built
  Jan 27 2020)
Content-language: en
Subject: ***Spam?***
  =?UTF-8?Q?=CE=95=CF=80=CE=B5=CE=AF=CE=B3=CE=BF=CF=85=CF=83=CE=B1_=CE=95?=
  =?UTF-8?Q?=CE=BD=CE=B7=CE=BC=CE=AD=CF=81=CF=89=CF=83=CE=B7:_=CE=91=CE=BD?=
  =?UTF-8?Q?=CE=B1=CE=B2=CE=AC=CE=B8=CE=BC=CE=B9=CF=83=CE=B7_=CE=91=CF=83?=
  =?UTF-8?Q?=CF=86=CE=B1=CE=BB=CE=B5=CE=AF=CE=B1=CF=82_=CE=91=CF=80=CE=B1?=
  =?UTF-8?Q?=CE=B9=CF=84=CE=B5=CE=AF=CF=84=CE=B1=CE=B9_=CE=B3=CE=B9=CE=B1_?=
  =?UTF-8?Q?=CF=84=CE=BF=CE=BD_=CE=9B=CE=BF=CE=B3=CE=B1=CF=81=CE=B9=CE=B1?=
  =?UTF-8?Q?=CF=83=CE=BC=CF=8C_=CF=83=CE=B1=CF=82_=CF=83=CF=84=CE=B7=CE=BD_?=
  =?UTF-8?Q?=CE=95=CE=B8=CE=BD=CE=B9=CE=BA=CE=AE_=CE=A4=CF=81=CE=AC=CF=80?=
  =?UTF-8?Q?=CE=B5=CE=B6=CE=B1?= !
X-Accept-Language: en
...

How can we search for a particular string in From / Subject?

Note: In the above case, encoded text is in Greek language.

I would appreciate your feedback.

We are at Rocky Linux 8, with spamassassin 3.4.6 (under amavis).

Best regards,
Nick