spamassassin-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Bill Cole" <sausers-20150...@billmail.scconsult.com>
Subject Re: phishing by deceptive From address detection
Date Wed, 18 Dec 2019 14:27:48 GMT
On 18 Dec 2019, at 8:35, AJ Weber wrote:

>>> The 'B' characters have been overlaid with a clearly visible slash,
>>> which isn't very clever in a phishing email.
>
>
> Interesting, Thunderbird does not show any visible slash.  Just 
> "BB&T" - though the font looks different.

The  "=CC=B7" sequence in the quoted-printable part is a UTF-8 
"Combining Short Solidus Overlay" which is a diacritical mark that puts 
a solidus (slash) through the preceeding character. In some fonts at 
some sizes, adding that to a 'B' makes very little difference in which 
pixels are which color on-screen.


-- 
Bill Cole
bill@scconsult.com or billcole@apache.org
(AKA @grumpybozo and many *@billmail.scconsult.com addresses)
Not For Hire (currently)

Mime
View raw message