Detecting ISO Encoded Subjects

["Joseph D. Wagner" <th...@josephdwagner.info>]

A lot of my spam lately has had an ISO encoded subject line, like:
=?iso-8859-1?B?T2ZmaWNlIHNvZnR3YXJlIC0gNzUlIE9GRg==?=

Since none of my friends ever use ISO encoded subject lines, I wanted to create a rule to flags those messages.  However, everything I've found indicates that Spamassassin tests the decoded subject line, not the raw subject line.

I've tried:
  header SUBJECT_ISO_ENCODED Subject =~ /=?iso-8859/i
but that doesn't seem to work.

Is there any way I can run a rule on the raw header to detect whether or not it's encoded?  If so, could you please show me how?

TIA.

Joseph D. Wagner

Re: Detecting ISO Encoded Subjects

[Duane Hill <du...@yournetplus.com>]

On Friday, July 22, 2005 at 12:32:34 PM, theman@josephdwagner.info confabulated:

> A lot of my spam lately has had an ISO encoded subject line, like:
> =?iso-8859-1?B?T2ZmaWNlIHNvZnR3YXJlIC0gNzUlIE9GRg==?=

> Since none of my friends ever use ISO encoded subject lines, I
> wanted to create a rule to flags those messages.  However,
> everything I've found indicates that Spamassassin tests the decoded
> subject line, not the raw subject line.

> I've tried:
>   header SUBJECT_ISO_ENCODED Subject =~ /=?iso-8859/i
> but that doesn't seem to work.

  From a previous message to the list I dug up:

  header RULE_NAME HeaderName:raw ~=//. (3.0.0 or higher) Checks header without
  any QP or base64 decoding. Best for looking for illegal unencoded
  characters in...

> Is there any way I can run a rule on the raw header to detect
> whether or not it's encoded?  If so, could you please show me how?

> TIA.

> Joseph D. Wagner


-----------------------------------------------------------
 Duane Hill  |  Network Operations  - YourNetPlus.Com, Inc.
             | E-mail Administrator - duane@yournetplus.com
-----------------------------------------------------------
"This message is made of 100% recycled electrons."