Chinese spam rules

[David H. Lipman]

Subject: =?gb2312?B?aWx2N3VobjRn06pgz/pgyv1gvt1gt9ZgzvY=?=
=?gb2312?B?Li0t0czMqMrQwPa+p8qvssS9+LP2v9rT0M/euavLvg==?=

I have tried a POP3 rule
If Subject contains; =?gb2312 Delete from server

But it doesn't work.

How best to deal with this type of Chinese spam ?


--
Dave
Multi-AV Scanning Tool - http://multi-av.thespykiller.co.uk
http://www.pctipp.ch/downloads/dl/35905.asp

[David H. Lipman]

From: "Guy" <Use-Reply-To-Address-Header@[127.1]>

> David H. Lipman wrote:
>
>> Subject: =?gb2312?B?aWx2N3VobjRn06pgz/pgyv1gvt1gt9ZgzvY=?=
>> =?gb2312?B?Li0t0czMqMrQwPa+p8qvssS9+LP2v9rT0M/euavLvg==?=
>>
>> I have tried a POP3 rule
>> If Subject contains; =?gb2312 Delete from server
>>
>> But it doesn't work.
>>
>> How best to deal with this type of Chinese spam ?
>>
>
>
>
>

> Try a POP3 Rule consist of these two lines:
>
> If header "S" contains "GB2312" LogicalAnd ""
> If expression headers matches "CONTENT-TYPE:*GB2312" LeaveOnServer ""
>
>
> See if the unwanted emails are left on the server.


Will do !

[David H. Lipman]

From: "Guy" <Use-Reply-To-Address-Header@[127.1]>

> David H. Lipman wrote:
>

>> Subject: =?gb2312?B?aWx2N3VobjRn06pgz/pgyv1gvt1gt9ZgzvY=?=
>> =?gb2312?B?Li0t0czMqMrQwPa+p8qvssS9+LP2v9rT0M/euavLvg==?=
>>
>> I have tried a POP3 rule
>> If Subject contains; =?gb2312 Delete from server
>>
>> But it doesn't work.
>>
>> How best to deal with this type of Chinese spam ?
>>
>
>
>
>

> Try a POP3 Rule consist of these two lines:
>
> If header "S" contains "GB2312" LogicalAnd ""
> If expression headers matches "CONTENT-TYPE:*GB2312" LeaveOnServer ""
>
>
> See if the unwanted emails are left on the server.

Doesn't work :-(

[David H. Lipman]

From: "Guy" <Use-Reply-To-Address-Header@[127.1]>

> David H. Lipman wrote:
>
>> From: "Guy" <Use-Reply-To-Address-Header@[127.1]>
>>
>>> David H. Lipman wrote:
>>>
>>>> Subject: =?gb2312?B?aWx2N3VobjRn06pgz/pgyv1gvt1gt9ZgzvY=?=
>>>> =?gb2312?B?Li0t0czMqMrQwPa+p8qvssS9+LP2v9rT0M/euavLvg==?=
>>>>
>>>> I have tried a POP3 rule
>>>> If Subject contains; =?gb2312 Delete from server
>>>>
>>>> But it doesn't work.
>>>>
>>>> How best to deal with this type of Chinese spam ?
>>>>
>>>
>>> Try a POP3 Rule consist of these two lines:
>>>
>>> If header "S" contains "GB2312" LogicalAnd ""
>>> If expression headers matches "CONTENT-TYPE:*GB2312" LeaveOnServer ""
>>>
>>>
>>> See if the unwanted emails are left on the server.
>>
>>
>> Doesn't work :-(
>>
>
>

> Try:
>
> If expression headers matches "subject*gb2312*" LeaveOnServer ""

It doesn't work on "gb2312" as if the characterset is interpreted first then the rules and
Regular Expressions are implemented.

[David H. Lipman]

From: "Guy" <Use-Reply-To-Address-Header@[127.1]>

> David H. Lipman wrote:
>
>> From: "Guy" <Use-Reply-To-Address-Header@[127.1]>
>>
>>> David H. Lipman wrote:
>>>
>>>> From: "Guy" <Use-Reply-To-Address-Header@[127.1]>
>>>>
>>>>> David H. Lipman wrote:
>>>>>
>>>>>> Subject: =?gb2312?B?aWx2N3VobjRn06pgz/pgyv1gvt1gt9ZgzvY=?=
>>>>>> =?gb2312?B?Li0t0czMqMrQwPa+p8qvssS9+LP2v9rT0M/euavLvg==?=
>>>>>>
>>>>>> I have tried a POP3 rule
>>>>>> If Subject contains; =?gb2312 Delete from server
>>>>>>
>>>>>> But it doesn't work.
>>>>>>
>>>>>> How best to deal with this type of Chinese spam ?
>>>>>>
>>>>>
>>>>> Try a POP3 Rule consist of these two lines:
>>>>>
>>>>> If header "S" contains "GB2312" LogicalAnd ""
>>>>> If expression headers matches "CONTENT-TYPE:*GB2312" LeaveOnServer ""
>>>>>
>>>>>
>>>>> See if the unwanted emails are left on the server.
>>>>
>>>> Doesn't work :-(
>>>>
>>>
>>> Try:
>>>
>>> If expression headers matches "subject*gb2312*" LeaveOnServer ""
>>
>> It doesn't work on "gb2312" as if the characterset is interpreted
>> first then the rules and Regular Expressions are implemented.
>>
>>
>
>

> I tried the above rule and PMail does LeaveOnServer.
>
> Here is shown Gmail display:
> <http://oi56.tinypic.com/2rgfh2v.jpg>
>
> Here is shown Pmail "Selective mail download" dialog:
> <http://oi51.tinypic.com/2uj1k0h.jpg>


I'll give it another shot.

Also I posted an addendum that didn't make it to the News Server. The following works...
http://multi-av.thespykiller.co.uk/Image5.jpg

[David H. Lipman]

From: "Guy" <Use-Reply-To-Address-Header@[127.1]>

>>> Try:
>>>
>>> If expression headers matches "subject*gb2312*" LeaveOnServer ""
>>
>> It doesn't work on "gb2312" as if the characterset is interpreted
>> first then the rules and Regular Expressions are implemented.
>>
>>
>
>

> I tried the above rule and PMail does LeaveOnServer.
>
> Here is shown Gmail display:
> <http://oi56.tinypic.com/2rgfh2v.jpg>
>
> Here is shown Pmail "Selective mail download" dialog:
> <http://oi51.tinypic.com/2uj1k0h.jpg>

I must be implementing it incorrectly as my test email comes through. :-(

Can you please post a URL to a screenshot of the Regular Expression rule.

BTW: Thanx for your help. It is greatly appreciated !

[David H. Lipman]

From: "Guy" <Use-Reply-To-Address-Header@[127.1]>

>
> My test mail is constructed by a cut and paste of the
> Subject line that you had originallty posted:
>
> Subject:
> =?gb2312?B?aWx2N3VobjRn06pgz/pgyv1gvt1gt9ZgzvY=?==?gb2312?B?Li0t0czMqMrQwPa+p8qvssS9+LP2v9
> rT0M/euavLvg==?=
>
> <http://oi53.tinypic.com/2rd9aw0.jpg>

I'm doing a LOUSY job at you very good instructions as the rule isn't working. :-(

http://multi-av.thespykiller.co.uk/PMail1.jpg

http://multi-av.thespykiller.co.uk/PMail2.jpg

[Michael in der Wiesche]

Am 19.10.2011, 23:52 Uhr, schrieb David H. Lipman
<DLipman~nospam~@verizon.net>:

> From: "Guy" <Use-Reply-To-Address-Header@[127.1]>
>
>>
>> My test mail is constructed by a cut and paste of the
>> Subject line that you had originallty posted:
>>
>> Subject:
>> =?gb2312?B?aWx2N3VobjRn06pgz/pgyv1gvt1gt9ZgzvY=?==?gb2312?B?Li0t0czMqMrQwPa+p8qvssS9+LP2v9
>> rT0M/euavLvg==?=
>>
>> <http://oi53.tinypic.com/2rd9aw0.jpg>
>
> I'm doing a LOUSY job at you very good instructions as the rule isn't
> working. :-(

Create a regular expression rule containing "Subject*gb2312*" (don't
forget the trailing asterisk).


Michael

--
PGP Key ID (RSA 2048): 0xC45D831B
PGP Plugin for Pegasus Mail: <http://www.pmpgp.de/pmpgp/>
S/MIME Fingerprint: 26 5c a3 60 02 c6 e3 8a 75 70 d5 6a 67 ff d3 8d b0 b5
5e 5b

[David H. Lipman]

From: "Michael in der Wiesche" <---idw.d...@t-online.de>

> Am 19.10.2011, 23:52 Uhr, schrieb David H. Lipman <DLipman~nospam~@verizon.net>:
>
>> From: "Guy" <Use-Reply-To-Address-Header@[127.1]>
>>
>>>
>>> My test mail is constructed by a cut and paste of the
>>> Subject line that you had originallty posted:
>>>
>>> Subject:
>>> =?gb2312?B?aWx2N3VobjRn06pgz/pgyv1gvt1gt9ZgzvY=?==?gb2312?B?Li0t0czMqMrQwPa+p8qvssS9+LP2
>>> v9 rT0M/euavLvg==?=
>>>
>>> <http://oi53.tinypic.com/2rd9aw0.jpg>
>>
>> I'm doing a LOUSY job at you very good instructions as the rule isn't working. :-(
>
> Create a regular expression rule containing "Subject*gb2312*" (don't forget the
> trailing asterisk).
>
>

Michael, I have done that albeit w/o the quotation marks.
http://multi-av.thespykiller.co.uk/PMail2.jpg

Is the above screenshot not correct ?

[Michael in der Wiesche]

Am 20.10.2011, 16:40 Uhr, schrieb David H. Lipman
<DLipman~nospam~@verizon.net>:

> Michael, I have done that albeit w/o the quotation marks.
> http://multi-av.thespykiller.co.uk/PMail2.jpg
>
> Is the above screenshot not correct ?

It looks correct - I didn't test a server side rule, though, but it worked
ok with a local test rule. I have a server side rule containing
"*charset=*GB2312*", enabled for headers and body: The latter is necessary
for emails with ASCII subject but Chinese body contents if using
mutltipart/alternative.

[David H. Lipman]

From: "Michael in der Wiesche" <---idw.d...@t-online.de>

> Am 20.10.2011, 16:40 Uhr, schrieb David H. Lipman <DLipman~nospam~@verizon.net>:
>
>> Michael, I have done that albeit w/o the quotation marks.
>> http://multi-av.thespykiller.co.uk/PMail2.jpg
>>
>> Is the above screenshot not correct ?
>
> It looks correct - I didn't test a server side rule, though, but it worked ok with a
> local test rule. I have a server side rule containing "*charset=*GB2312*", enabled for
> headers and body: The latter is necessary for emails with ASCII subject but Chinese
> body contents if using mutltipart/alternative.
>

Danke Michael.

[David H. Lipman]

From: "Michael in der Wiesche" <---idw.d...@t-online.de>

> Am 20.10.2011, 16:40 Uhr, schrieb David H. Lipman <DLipman~nospam~@verizon.net>:
>
>> Michael, I have done that albeit w/o the quotation marks.
>> http://multi-av.thespykiller.co.uk/PMail2.jpg
>>
>> Is the above screenshot not correct ?
>
> It looks correct - I didn't test a server side rule, though, but it worked ok with a
> local test rule. I have a server side rule containing "*charset=*GB2312*", enabled for
> headers and body: The latter is necessary for emails with ASCII subject but Chinese
> body contents if using mutltipart/alternative.
>

If I send any email from any account with the following Subject...
=?gb2312?B?dHFp178u1L0uyMsuwaYu18ou1LQuudwuwO0uyMs=?=

Rules fail both on the Verizon server spam filter an in P-Mail

When I drop the prepended "=" from the subject
?gb2312?B?dHFp178u1L0uyMsuwaYu18ou1LQuudwuwO0uyMs=?=

Rules work as I intended them to.

Which again leads me to believe the string is being interpreted first and then the rules
are applied.

[Nil]

On 20 Oct 2011, "David H. Lipman" <DLipman~nospam~@Verizon.Net>
wrote in comp.mail.pegasus-mail.ms-windows:

> If I send any email from any account with the following Subject...
>=?gb2312?B?dHFp178u1L0uyMsuwaYu18ou1LQuudwuwO0uyMs=?=
>
> Rules fail both on the Verizon server spam filter an in P-Mail
>
> When I drop the prepended "=" from the subject
> ?gb2312?B?dHFp178u1L0uyMsuwaYu18ou1LQuudwuwO0uyMs=?=
>
> Rules work as I intended them to.
>
> Which again leads me to believe the string is being interpreted
> first and then the rules are applied.

I believe you're right about Pegasus. I tried sending some test emails
with encoded subjects and I couldn't get any filter rules to trigger on
any portion that was escaped by "=". However, they would react to a
plain text portion surrounded by escaped stuff.

I seem to recall this issue being discussed many years ago on the
Pegasus mailing list, but I can't find any record in my archives right
now.

I think you'll need to base your filter on some other criteria than the
Subject.

[David H. Lipman]

From: "Nil" <redn...@REMOVETHIScomcast.net>

Thanx Nil. I have a thread going in the P-Mail forums. At this time, I am not giving up.

http://community.pmail.com/forums/31339/ShowThread.aspx#31339

[Michael in der Wiesche]

Am 21.10.2011, 06:02 Uhr, schrieb Nil <redn...@removethiscomcast.net>:

> On 20 Oct 2011, "David H. Lipman" <DLipman~nospam~@Verizon.Net>
> wrote in comp.mail.pegasus-mail.ms-windows:
>
>> If I send any email from any account with the following Subject...
>> =?gb2312?B?dHFp178u1L0uyMsuwaYu18ou1LQuudwuwO0uyMs=?=
>>
>> Rules fail both on the Verizon server spam filter an in P-Mail
>>
>> When I drop the prepended "=" from the subject
>> ?gb2312?B?dHFp178u1L0uyMsuwaYu18ou1LQuudwuwO0uyMs=?=
>>
>> Rules work as I intended them to.
>>
>> Which again leads me to believe the string is being interpreted
>> first and then the rules are applied.

Well, I would concur with this conclusion if it wouldn't work for me
either, but it does: I just did another check with POP3 filtering, and it
works even with the most restricted settings (i.e. filtering only headers
without downloading any parts of the body). Any chance that you have some
options enabled on your POP3 definition's "Download controls" page like
"Download only unread mail" which might effect filtering? Or could it be
an issue with your provider?

[David H. Lipman]

From: "Michael in der Wiesche" <---idw.d...@t-online.de>

> Am 21.10.2011, 06:02 Uhr, schrieb Nil <redn...@removethiscomcast.net>:
>
>> On 20 Oct 2011, "David H. Lipman" <DLipman~nospam~@Verizon.Net>
>> wrote in comp.mail.pegasus-mail.ms-windows:
>>
>>> If I send any email from any account with the following Subject...
>>> =?gb2312?B?dHFp178u1L0uyMsuwaYu18ou1LQuudwuwO0uyMs=?=
>>>
>>> Rules fail both on the Verizon server spam filter an in P-Mail
>>>
>>> When I drop the prepended "=" from the subject
>>> ?gb2312?B?dHFp178u1L0uyMsuwaYu18ou1LQuudwuwO0uyMs=?=
>>>
>>> Rules work as I intended them to.
>>>
>>> Which again leads me to believe the string is being interpreted
>>> first and then the rules are applied.
>
> Well, I would concur with this conclusion if it wouldn't work for me either, but it does:
> I just did another check with POP3 filtering, and it works even with the most
> restricted settings (i.e. filtering only headers without downloading any parts of the
> body). Any chance that you have some options enabled on your POP3 definition's
> "Download controls" page like "Download only unread mail" which might effect filtering?
> Or could it be an issue with your provider?
>

Good idea so I tried another server. Same result.

A screen capture of the "Download controls" has been posted before but here it is again.
http://multi-av.thespykiller.co.uk/PMail1.jpg

There must be a configuration setting that needs to be set/changed in my setup to alter
the way the rules are inititated.

[Michael in der Wiesche]

Am 21.10.2011, 17:14 Uhr, schrieb David H. Lipman
<DLipman~nospam~@verizon.net>:

> There must be a configuration setting that needs to be set/changed in my
> setup to alter
> the way the rules are inititated.

This may have been asked as well, but nevertheless: Did you try a local
filter rule you can test on your machine so we can exclude any external
effects? I really don't know of any other configuration settings affecting
filtering.

[David H. Lipman]

From: "Michael in der Wiesche" <---idw.d...@t-online.de>

> Am 21.10.2011, 17:14 Uhr, schrieb David H. Lipman <DLipman~nospam~@verizon.net>:
>
>> There must be a configuration setting that needs to be set/changed in my setup to
>> alter
>> the way the rules are inititated.
>
> This may have been asked as well, but nevertheless: Did you try a local filter rule you
> can test on your machine so we can exclude any external effects? I really don't know of
> any other configuration settings affecting filtering.
>
>

Yes Michael, I did/do.

[Nil]

On 21 Oct 2011, "David H. Lipman" <DLipman~nospam~@Verizon.Net>
wrote in comp.mail.pegasus-mail.ms-windows:

> There must be a configuration setting that needs to be set/changed
> in my setup to alter the way the rules are inititated.

I only tried local filters, but I can't make them work. Here's what I
did:

I don't have any Chinese spam messages with encoded subjects in my spam
folder, so I made my own sample. I found a spam usenet post in the
Google archive, that had a subject in Hindi or something. When I
forwarded it to my email, Google encoded it for me like this:

Subject: =?windows-1256?B?RndkOiDj5t7aIOHdys0gx+Hj5sfe2iDH4ePNzObI?=
=?windows-1256?B?5SDmx+Hj4+Tm2uUg5sfh49Td0eUgKOHHIMrTys7P4+Ug?=
=?windows-1256?B?3ewg49rV7ckgx+Hh5Sk=?=

The subject appears in Pegasus as "Fwd: <a bunch of Hindi characters>"

Some of my Expression criteria were:

Subject:*
Subject: *
Subject: Fwd*
Subject: *<a substring of the Hindi characters copied and pasted
directly from the message into the Regular Expression
criteria box.>
Subject: =*
Subject:*windows-1256*
Subject: [=]*
Subject:?[=]*
Subject:*[=]*

Only the first four triggered my filter. This seems to tell me that
Pegasus decodes the subject before evaluating the rule. There seems to
be no way to make Pegasus look at the encoding, only the results. It
doesn't see the character set designation.

[Nil]

On 22 Oct 2011, Guy <Use-Reply-To-Address-Header@[127.1]> wrote in
comp.mail.pegasus-mail.ms-windows:

> Try omitting the colon (:).
>
> Subject*windows-1256*
>
>
> The below POP3 rule functions; the message is left on the server.
>
> If expression headers matches "Subject*windows-1256*"
> LeaveOnServer ""

I'm just doing a local download filter, not a server-side filter, but
it should still work, right? But it doesn't. I wouldn't think the colon
would make a difference, and it doesn't for me in this example.

[Nil]

On 22 Oct 2011, Guy <Use-Reply-To-Address-Header@[127.1]> wrote in
comp.mail.pegasus-mail.ms-windows:

> That is how I first tested filter rules before
> creating the POP3 rule previously posted.
>
>
> I just did...
> Created a General rule set.
> Content of the .PMC file:
>
> _COLOR ASIAN SUBJECTS
> If expression headers matches "Subject*windows-1256*" Highlight
> "15" If expression headers matches "subject*gb2312*" Highlight
> "16"
>
> Performed a "Selective mail download" to retrieve the four mails
> that were "stuck" due to matching two LeaveOnServer rules.
> Moved the messages to and opened the folder, then applied the
> General rule set. This resulted in the coloring of all four
> messages.

I bounced a copy of my sample message to myself. Then I disabled the
"Delete mail on server after retrieval" and "Download only unread mail"
options in my POP3 definition. Then I just kept downloading the same
message, varying the filter criteria each time to see the effect. The
criteria:

If expression headers matches "Subject*windows-1256*" Highlight "5"

does not work for me.

[David H. Lipman]

From: "Nil" <redn...@REMOVETHIScomcast.net>

And not for me.

So why does it work for Guy ?

[Michael in der Wiesche]

Am 22.10.2011, 13:28 Uhr, schrieb David H. Lipman
<DLipman~nospam~@verizon.net>:

>> does not work for me.
>
> And not for me.
>
> So why does it work for Guy ?

And for me: Do you use Pegasus Mail's built-in POP3 handling or any other
gateway (like Mercury, e.g.)? I assume the latter would force you into
creating a filter rule in Mercury instead of Pegasus Mail ...

[David H. Lipman]

From: "Michael in der Wiesche" <---idw.d...@t-online.de>

> Am 22.10.2011, 13:28 Uhr, schrieb David H. Lipman <DLipman~nospam~@verizon.net>:
>
>>> does not work for me.
>>
>> And not for me.
>>
>> So why does it work for Guy ?
>
> And for me: Do you use Pegasus Mail's built-in POP3 handling or any other gateway (like
> Mercury, e.g.)? I assume the latter would force you into creating a filter rule in
> Mercury instead of Pegasus Mail ...
>
>

P-Mail with two POP3 servers at TCP port 110. One being; incoming.verizon.net

[Michael in der Wiesche]

Am 22.10.2011, 16:16 Uhr, schrieb David H. Lipman
<DLipman~nospam~@verizon.net>:

>> And for me: Do you use Pegasus Mail's built-in POP3 handling or any
>> other gateway (like
>> Mercury, e.g.)? I assume the latter would force you into creating a
>> filter rule in
>> Mercury instead of Pegasus Mail ...
>>
>>
>
> P-Mail with two POP3 servers at TCP port 110. One being;
> incoming.verizon.net

Even if it sounds weird: Did you try with various messages or only a
single one (there might be something very special with a certain one)? And
did you try a new clean filter set which only contains a single rule so
other rules don't affect the results?

[David H. Lipman]

From: "Michael in der Wiesche" <---idw.d...@t-online.de>

> Am 22.10.2011, 16:16 Uhr, schrieb David H. Lipman <DLipman~nospam~@verizon.net>:
>
>>> And for me: Do you use Pegasus Mail's built-in POP3 handling or any other gateway
>>> (like
>>> Mercury, e.g.)? I assume the latter would force you into creating a filter rule in
>>> Mercury instead of Pegasus Mail ...
>>>
>>>
>>
>> P-Mail with two POP3 servers at TCP port 110. One being; incoming.verizon.net
>
> Even if it sounds weird: Did you try with various messages or only a single one (there
> might be something very special with a certain one)? And did you try a new clean filter
> set which only contains a single rule so other rules don't affect the results?
>
>

I kept samples of the spam. I compared all raw views of the spam. I went to a spam
message, viewed its full header and body in raw format and copied the text of the subject
line or the text of a from line.

I went to two other emails accounts. I created a new message in each back to my Verizon
account. Pasted the text of the subject line in the subject field of both emails. Sent
both emails. Both were received. One of those two accounts was Yahoo. Subsequent tests
from Yahoo was perceived negatively by Yahoo and thus I had to stop all subsequent tests
from Yahoo. The other email account is a private service with no restrictions so I
continued performing all tests from that account.

I have not tried backing up my POP3 rules set and creating a fresh rules set. I have used
it for years.

I have tried both POP3, General and "Rules applied when folder is opened". All with
negative results.

Tested strings...
=?gb2312?B?dHFp178u1L0uyMsuwaYu18ou1LQuudwuwO0uyMs=?=
=?gb2312?B?LrLFenJlemFhZnFy?=
=?gb2312?B?uu7S49XR?=
=?gb2312?B?aWx2N3VobjRn06pgz/pgyv1gvt1gt9ZgzvY=?=

All tests fail. That is unless I do not included the prepended "=", then the rules work.

[Michael in der Wiesche]

Am 21.10.2011, 06:02 Uhr, schrieb Nil <redn...@removethiscomcast.net>:

> I believe you're right about Pegasus. I tried sending some test emails
> with encoded subjects and I couldn't get any filter rules to trigger on
> any portion that was escaped by "=". However, they would react to a
> plain text portion surrounded by escaped stuff.

Did you actually use a regular expression filter? Simple header line
filters will only work on the decoded headers while expression filters
also work on encoded ones. And did you try local or remote (server side)
filtering? The former will not work if these message are already handled
by Spamhalter or Content Control.

So far you are the only person aside from David seeing a failure, hence it
would be important to know what's causing this in your case (even David
Harris did some extended testing without finding other results than the
ones reported above).

[Nil]

On 01 Nov 2011, "Michael in der Wiesche" <---idw.d...@t-online.de>
wrote in comp.mail.pegasus-mail.ms-windows:

> Did you actually use a regular expression filter?

Yes. The subject of my test message is (lines broken just as I'm
pasting them):

Subject: =?windows-1256?B?RndkOiDj5t7aIOHdys0gx+Hj5sfe2iDH4ePNzObI?=
=?windows-1256?B?5SDmx+Hj4+Tm2uUg5sfh49Td0eUgKOHHIMrTys7P4+Ug?=
=?windows-1256?B?3ewg49rV7ckgx+Hh5Sk=?=

The expression I'm using to try to catch it is:

Subject*windows-1256*

> And did you try local or remote (server side) filtering?

Local.

> The former will not work if these message are already handled by
> Spamhalter or Content Control.

Content Control is and has been disabled. Spamhalter was turned on,
but I just now turned it off and it made no difference.