[PLUG-TALK] Obfuscated Spam

[Rich Shepard]

On Wed, 30 Sep 2009, Larry Williams wrote:

> In my experience I have found that such emails have always been spam,
> especially if it contains no printable message.  One place I often look
> for examples is the Usenet group news.admin.net-abuse.sightings. Mail
> admins and honeypot operators often send spam headers to that newsgroup. 
> The messages are sometimes discussed in new.admin.net-abuse.email, but
> there is much more noise than signal there.

Larry,

   Thank you for your insight and Usenet reference. I've added that transfer
encoding to header_checks as a warning. If I see no false positives in the
next couple of weeks, I'll convert that warning to a rejection.

Rich