Print Page | Close Window

Encoded subject not filtered

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=3373
Printed Date: 11 December 2025 at 11:17am


Topic: Encoded subject not filtered
Posted By: Guests
Subject: Encoded subject not filtered
Date Posted: 02 April 2004 at 6:42pm

I'm seeing a lot of spam with an encoded subject line.  Here's an example:

Subject: =?ISO-8859-1?b?VHJ5IFZpYWckcmE=?=

When decoded, it looks like this:

Subject: Try Viag$ra

Viag$ra should be caught by a regex I use (and I have used the regex test feature to verify that).  I thought maybe the message was being scanned before the subject was decoded, so I made a regex, ((?i)Subject:s?=?), to catch "Subject: =?" (and verified that it worked in the test window) but it didn't work.  I then upgraded to 1.2.0.212 because of this release note:

{TODO -cNew : Subject lines are now prefixed with the words "Subject:", allowing RegEx searches to be more specific by limiting them to the subject line only}

Unfortunately it still isn't working.  Any ideas?

Thanks

 


Replies:
Posted By: Guests
Date Posted: 02 April 2004 at 8:37pm

The backslashes in the regex in the original post are not being displayed here.  It actually is a working regex despite appearances.

Posted By: LogSat
Date Posted: 04 April 2004 at 12:39am

Alec,

Can you please either post and/or email us at mailto:support@logsat.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - support@logsat.com the exact regex expression you're using so we can duplicate (and hopefully fix) this?

Thanks,

Roberto F.
LogSat Software

Posted By: Desperado
Date Posted: 05 April 2004 at 10:51am

Alec,

I believe I understand what you are trying to do and why it seems to be failing.  I have emailed Roberto directly on this issue and you should hear back from him if you have not already resolved this issue.  This is NOT a straight forward issue with the ISO encoding in the subject because not only is it used by Spammers to obscure the actual content but is can also be a valid foreign language subject so some compromises have to be made and the ramifications must be  understood.

Regards,

Dan S.


Print Page | Close Window