[Mimedefang] Creating better idiots (spam blocking)

[Ashley M. Kirchner]

Every day you come up with a way to block charsets you don't want, and 
someone makes a better idiot. So here's the next "problem". How do I 
scan and properly block these? Notice the 'big5' charset, one of many 
that we block because there isn't anyone here that can read it anyway. 
However, because it's hidden in several layers of mime parts, it doesn't 
get blocked. So, how to?

----------
Return-Path: <hoV8N at tpts5.seed.net.tw>
Received: from serpico.pcraft.com (serpico.pcraft.com [204.144.132.162])
by ivanhoe.pcraft.com (8.13.0/8.13.0) with ESMTP id i6R6Fx4d032407
for <ashley at pcraft.com>; Tue, 27 Jul 2004 00:15:59 -0600
Received: from FHA02046 (61-220-64-35.HINET-IP.hinet.net [61.220.64.35])
by serpico.pcraft.com (8.13.0/8.13.0) with SMTP id i6R6AmIS020748
for <ashley at pcraft.com>; Tue, 27 Jul 2004 00:10:57 -0600
Date: Tue, 27 Jul 2004 00:10:48 -0600
Received: from titan
by ibm.com with SMTP id 4fDl4iFiMYCf2Cji6P;
Tue, 27 Jul 2004 14:10:58 +0800
Message-ID: <lAODvTvMmWvQ0H3 at kimo.com>
From: ???@serpico.pcraft.com
To:
Subject: 
=?big5?Q?=A7=D6=A8=D3=B3=F8=A6W->=A1u=A5x=B4=C1=AB=FC=C4=B9=AEa=AFZ=A1v=A7K=B6O=C1=BF=AEy?=
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----=_NextPart_y73tChHy4xaRZ4LjP"
X-Mailer: 4aCL4hXzAZkMCxSz6d
X-Priority: 3
X-MSMail-Priority: Normal
X-Scanned-By: MIMEDefang 2.43

This is a multi-part message in MIME format...

------=_NextPart_y73tChHy4xaRZ4LjP
Content-Type: multipart/alternative;
boundary="----=_NextPart_y73tChHy4xaRZ4LjPAA"

------=_NextPart_y73tChHy4xaRZ4LjPAA
Content-Type: text/html;
charset="big5"
Content-Transfer-Encoding: base64
Content-Disposition: inline

PGh0bWw+DQoNCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVpdj0iQ29udGVudC1U
eXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9YmlnNSI+DQo8bWV0
YSBuYW1lPSJHRU5FUkFUT1IiIGNvbnRlbnQ9Ik1pY3Jvc29mdCBGcm9udFBh
Z2UgNC4wIj4NCjxtZXRhIG5hbWU9IlByb2dJZCIgY29udGVudD0iRnJvbnRQ
...[ snip ]...
PfXuHKe9wNTq2j5IBzf44IPgQeZSQMlqh75JBDb8gEME2KtbwAWOI2y04zbc
wENa6VxQQYQNLbRgtwkIS0+IA2Jo8ULXXhPWAQ9E3BA+6ePr30IHAKMHAGwg
BjFQYQlLIILXHHCDJeCvfzfoAO1sUjcTEAGB5Uug3TrGNgf8R0gHuMD6IgA8
agQCADs=

------=_NextPart_y73tChHy4xaRZ4LjP--

-- 
W | I haven't lost my mind; it's backed up on tape somewhere.
  +--------------------------------------------------------------------
  Ashley M. Kirchner <mailto:ashley at pcraft.com>   .   303.442.6410 x130
  IT Director / SysAdmin / WebSmith             .     800.441.3873 x130
  Photo Craft Laboratories, Inc.            .     3550 Arapahoe Ave. #6
  http://www.pcraft.com ..... .  .    .       Boulder, CO 80303, U.S.A.