Text shows something different than what is there.

Steve Campbell campbell at cnpapers.com
Wed Nov 28 18:23:18 GMT 2007



Scott Silva wrote:
> on 11/28/2007 6:02 AM Steve Campbell spake the following:
>>
>>
>> Scott Silva wrote:
>>> on 11/27/2007 2:11 PM Steve Campbell spake the following:
>>>> Sorry if this has been discussed before. I may have not realized 
>>>> what was being discussed until I saw it in front of me.
>>>>
>>>> We are getting tons of email with different sexual content. When 
>>>> viewing the source of the email through Thunderbird, a few of the 
>>>> lines show up like the following:
>>>>
>>>> IF YOU WANT TO F wol UC sty K SOMEBODY,
>>>> F oy U zb CK YOURSELF & SAVE YOUR MONEY!
>>>>
>>>> The email when viewed normally through Thunderbird (and probably 
>>>> most other clients) is different. If you remove all of the lower 
>>>> case letters and the spaces around them, you'll see what the viewed 
>>>> text is displaying.
>>>>
>>>> Can anyone explain what is going on there and a pretty good way to 
>>>> block this. The F-word is pretty blatant in these.
>>>>
>>>> Thanks,
>>>>
>>>> Steve Campbell
>>>>
>>>>
>>> If you can post a raw sample somewhere, we could try it and see what 
>>> existing stuff might hit it.
>>>
>> Scott,
>>
>> Thanks for the reply.
>>
>> Upon further review of the messages on other machines using other 
>> browsers, I find some HTML or something using bracketed "span" tags 
>> in between the letters.
>>
>> I'm not sure the best way to stop it for now, but at least I have a 
>> clue as to what's going on.
>>
>> Steve
>>
> Are you running any of the sare rules? Especially the obfu and 
> chickenpox ones?

I run just a very few, but I will look into the ones you mentioned.

Thanks, Scott

Steve
>
>



More information about the MailScanner mailing list