Spam Filter ISP Forums : Base64 encoding

Spam Filter ISP Forums : Base64 encoding https://www.logsat.com/spamfilter/forums/ Tue, 09 Jun 2026 11:38:18 +0000 Tue, 21 Dec 2004 21:18:00 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 11.04 360 https://www.logsat.com/spamfilter/forums/RSS_post_feed.asp?TID=4823 <![CDATA[Spam Filter ISP Forums]]> https://www.logsat.com/spamfilter/forums/forum_images/web_wiz_forums.png https://www.logsat.com/spamfilter/forums/ <![CDATA[Base64 encoding : As Dan correctly stated, there...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4823&PID=4836&title=base64-encoding#4836 Author: LogSat
Subject: 4823
Posted: 21 December 2004 at 9:18pm

As Dan correctly stated, there is an SpamFilter.ini file parameter to filter all emails with that encoding. We just noticed that while this addition was mentioned in the release notes for build 1.2.0.178, that was the *only* place where it was documented. The option is not documented in the readme.html file, nor does it appear with the default value of "0" in the SpamFilter.ini file. We apologize for this, and will update the documentation on the next release.

Roberto F.LogSat Software]]> Tue, 21 Dec 2004 21:18:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4823&PID=4836&title=base64-encoding#4836 <![CDATA[Base64 encoding : The only one's I can think...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4823&PID=4834&title=base64-encoding#4834 Author: Desperado
Subject: 4823
Posted: 21 December 2004 at 4:59pm

The only one's I can think of that I have comments on are:

MaxMsgSizeForKeywordScan=28

I have found that anything larger than this is a waste of CPU and energy.

ScanReceivedHeaders=1

Hmmm ... This can really cause the Bayesian to get whacked out on a high traffic server. I have it set to 1 (ON) but combine it with a short "CleanUpCorpusIntervalDays=" of say 1-4 days depending on traffic.

ExpireRetryQueueHours=24

This prevents totally undeliverable, queued messages from trying to "flush" forever. On my backup "Queuing" Server, This is set to more like 120 but my primary is set to 24.

Regards,

Dan S.

]]> Tue, 21 Dec 2004 16:59:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4823&PID=4834&title=base64-encoding#4834 <![CDATA[Base64 encoding : Yes thanks Dan! Any other "Dan"...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4823&PID=4831&title=base64-encoding#4831 Author: CyberBob
Subject: 4823
Posted: 21 December 2004 at 1:00pm

Yes thanks Dan!

Any other "Dan" entries we should add to the .ini file?

Thanks,

Bob

]]> Tue, 21 Dec 2004 13:00:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4823&PID=4831&title=base64-encoding#4831 <![CDATA[Base64 encoding : No problem ... let me know wow...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4823&PID=4830&title=base64-encoding#4830 Author: Desperado
Subject: 4823
Posted: 21 December 2004 at 12:54pm

No problem ... let me know wow it works out for you.

Dan S.

]]> Tue, 21 Dec 2004 12:54:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4823&PID=4830&title=base64-encoding#4830 <![CDATA[Base64 encoding : Thank you very much Dan ]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4823&PID=4829&title=base64-encoding#4829 Author: keizersozay
Subject: 4823
Posted: 21 December 2004 at 12:44pm

Thank you very much Dan]]> Tue, 21 Dec 2004 12:44:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4823&PID=4829&title=base64-encoding#4829 <![CDATA[Base64 encoding : It has bee around for quite a...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4823&PID=4827&title=base64-encoding#4827 Author: Desperado
Subject: 4823
Posted: 21 December 2004 at 12:15pm

It has bee around for quite a long time AND it is a manual entry only. Add in in and restart the SF Service

It shows up in the Reject Details as:

Found Keywords: [Found Content-Transfer-Encoding=base64 and Content-Type=text/html/plain]

Dan S.

]]> Tue, 21 Dec 2004 12:15:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4823&PID=4827&title=base64-encoding#4827 <![CDATA[Base64 encoding : I don't even has this setting...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4823&PID=4825&title=base64-encoding#4825 Author: CyberBob
Subject: 4823
Posted: 21 December 2004 at 11:53am

I don't even has this setting in my ini file? Is this a new revision or a manual entry only?]]> Tue, 21 Dec 2004 11:53:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4823&PID=4825&title=base64-encoding#4825 <![CDATA[Base64 encoding : First off ... the only "Valid"...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4823&PID=4824&title=base64-encoding#4824 Author: Desperado
Subject: 4823
Posted: 21 December 2004 at 11:46am

First off ... the only "Valid" Base 64 stuff should be image attachments NOT Text.
Second ... there is an INI setting which I HIGHLY recommend:
[server settings]
FilterBase64html=1
Regards,
Dan S

]]> Tue, 21 Dec 2004 11:46:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4823&PID=4824&title=base64-encoding#4824 <![CDATA[Base64 encoding : Good Morning, I've noticed...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4823&PID=4823&title=base64-encoding#4823 Author: keizersozay
Subject: 4823
Posted: 21 December 2004 at 10:08am

Good Morning,

I've noticed that the bayes filter has been blocking several emails that just appear as several lines of random text, but if you copy the entire text of the email out of the quar and save it as an eml file it opens to read perfectly readable spam. I was baffled as to how this is done. Then when reading some spam articles and found this http://david.carter-tod.com/base64/default.asp
This is how people encode those random lines of text.....

My question is this. The emails that are encoded this way seem to all have this line of text
"Content-Transfer-Encoding: base64" above the code.
Is there any reason that legit email would be encoded like this? I am thinking about blocking all email that has "Content-Transfer-Encoding: base64" in it anywhere.

Thanks.

]]> Tue, 21 Dec 2004 10:08:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4823&PID=4823&title=base64-encoding#4823