[SC-Help] Re: Starnge href html in recent spam

[Rev Beergoggles]

David Butler did pass the time by typing:
> Many unresolvable href entries in spam lately, in form like this below:
>
> href=3D"cid:filelist.xml at 01C54028.F8304670

cid = content id

> Just sloppy coding or some new trick ??

Scroll further down that spam and you will see something
base 64 encoded that probably looks like the following
snippet.

....
Content-Transfer-Encoding: base64
Content-ID: filelist.xml at 01C54028.F8304670
....

That's just an interal reference, spammy uses that for graphics and
html in an attempt to hide.

I use this handy tool to decode base 64
http://www.opinionatedgeek.com/dotnet/tools/Base64Decode/


-- 
rbg