[Rspamd-Users] BASE64 Encoding in FROM

[Wiethoff, Helge]

Hello everyone,

I'm seeing a lot of spam where the from field is BASE64 encoded:
From: =?UTF-8?B?TXVzdGVyLCBNYXggPG1heC5tdXN0ZXJAZXhhbXBsZS5jb20+?= <max.muster at example.com>

The decoded BASE64 string is an email address (including angle brackets). Unfortunately rspamd does not recognize the doubled FROM. Has anyone an idea how to filter those multiple froms?


Thanks
Helge

PS: Sorry for the "double post" -- I was asking this already in the chat but my client died right after asking...