[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Nmh-workers] OT: Content-Type boundary Matching /^_av-/.

From: Laura Creighton
Subject: Re: [Nmh-workers] OT: Content-Type boundary Matching /^_av-/.
Date: Fri, 03 Feb 2017 13:11:52 +0100

In a message of Fri, 03 Feb 2017 10:57:05 +0000, Ralph Corderoy writes:
>I've noticed an increase in spam I get over the last couple of months.
>I normally get quite a bit, but it shot up for a good few weeks and has
>only recently come back down as, presumably, the bullet found its home.
>But what struck me as odd is the vast bulk of the spam received has a
>MIME boundary that starts "_av-".
>    Content-Type: multipart/alternative; boundary="_av-Pq8nHjSyZNgotR7Q4uzLwA"
>I've looked for this in my ham, but don't find any, e.g.
>    pick --content-type _av-
>Presumably, some PHP email library beloved by spammers slaps on such a
>boundary for if it were the spam-producing software itself it would make
>detection rather trivial in most cases.
>So, my off-topic question is does anyone here have an idea what produces
>_av-, perhaps by having ham with a Mailer, etc.  I've tried the various
>code-search engines, but they're all useless;  electing to ignore and
>not index characters in "=-+_...".  Russ Cox's Google Code Search is
>much missed.
>Cheers, Ralph.

I have piles and piles of legitimate mail from Patreon that use this boundary
marker.  Want me to send you some?


reply via email to

[Prev in Thread] Current Thread [Next in Thread]