[Rspamd-Users] BASE64 Encoding in FROM

Wiethoff, Helge helge.wiethoff at thga.de
Tue Nov 13 15:13:52 UTC 2018

Hello everyone,

I'm seeing a lot of spam where the from field is BASE64 encoded:
From: =?UTF-8?B?TXVzdGVyLCBNYXggPG1heC5tdXN0ZXJAZXhhbXBsZS5jb20+?= <max.muster at example.com>

The decoded BASE64 string is an email address (including angle brackets). Unfortunately rspamd does not recognize the doubled FROM. Has anyone an idea how to filter those multiple froms?


PS: Sorry for the "double post" -- I was asking this already in the chat but my client died right after asking...

More information about the Users mailing list