Mailing List Archive: SpamAssassin: users

matching charset

Index | Next | Previous | View Threaded

thomas.kinghorn at gmail

Mar 1, 2012, 10:13 PM

Post #1 of 4 (289 views)
Permalink

matching charset

morning list

Please could you advise as to how I would match this charset (iso-8859-1)

I would like to include it as part of a meta-test for phishing
however, my attempts have failed.

a queued message shows

<snip>
Content-Type: multipart/mixed; boundary="===============0918654631=="
MIME-Version: 1.0
Subject: ABSA:Security Centre
To: Recipients <NOTIFYME [at] absa>
From: NOTIFYME [at] absa
Date: Thu, 1 Mar 2012 21:20:49 +0200

You will not see this in a MIME-aware mail reader.
--===============0918654631==
Content-Type: multipart/alternative; boundary="===============1047215777=="
MIME-Version: 1.0

--===============1047215777==
Content-Type: text/plain; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body

</snip>

The rule I created is:
header __CTYPE_ISO8859 Content-Type =~ /charset="iso-8859-1"/

I used the FSL_CTYPE_WIN1251 rule in 72_active.cf as an example.

However, it fails to match.

Thank you
Tom

martin at gregorie

Mar 2, 2012, 3:33 AM

Post #2 of 4 (266 views)
Permalink

Re: matching charset [In reply to]

On Fri, 2012-03-02 at 08:13 +0200, Tom Kinghorn wrote:
> morning list
>
> Please could you advise as to how I would match this charset (iso-8859-1)
>
Are you using the MimeMagic plugin? IIRC you need it to test MIME
headers.

Martin

KMcGrail at PCCC

Mar 2, 2012, 4:21 AM

Post #3 of 4 (266 views)
Permalink

Re: matching charset [In reply to]

On 3/2/2012 1:13 AM, Tom Kinghorn wrote:
> morning list
>
> Please could you advise as to how I would match this charset (iso-8859-1)
>
> I would like to include it as part of a meta-test for phishing
> however, my attempts have failed.
Hi Tom,
A - The charset in the second half isn't a header. It's part of the
mime enclosure heading. Have you looked at the MIMEHeader plugin?

B - iso 8859 1 is essentially the Western charset. I don't think you'll
find it indicative of much spam or ham.

regards,
KAM

thomas.kinghorn at gmail

Mar 2, 2012, 4:24 AM

Post #4 of 4 (270 views)
Permalink

Re: matching charset [In reply to]

On 02/03/2012 14:21, Kevin A. McGrail wrote:
>
> On 3/2/2012 1:13 AM, Tom Kinghorn wrote:
>> morning list 9 1 is essentially the Western charset. I don't think
>> you'll find it indicative of much spam or ham.
>
> regards,
> KAM
>
Thanks to all who have replied.

I am going to add the charset as part of a meta test.

regards
Tom

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads