Why are some scam messages encrypted when viewing the source code
I have been using Thunderbird since its inception. I have noticed a pattern recently where more spam and phishing messages present encryption when I "view source". Normally, the text is visible.
Just curious regarding their technique, how that works and whether it can be resolved.
I can send you a copy of the message if you are interested. It is the classic DocuSign scam.
選ばれた解決策
Like I mentioned, this is a bit of the email body that has been encoded to Base64. Not "encrypted." There are many on-line decoders (here's one: https://www.w3schools.com/tools/tool_base64.php ). When you plug your excerpt into it you'll see that it's just a bit of html code that would be part of the email's formatting. There's nothing inherently dangerous in this small bit, but there may be a malicious attachment elsewhere in the message or links to a malicious web site.
Legit senders might encode their entire message, too, so that in of itself isn't a reliable sign of spam. And ALL binary attachments will be encoded for transmission. That's part of the standard email protocols.
この投稿は Lin により に変更されました
すべての返信 (5)
This is entirely up the the sender. There's nothing at all you can do about it.
What you describe as "encrypted" is probably really "encoded", that is the content of the email can be encoded to plain text for transmission. It's then un-encoded for you by your email agent (Thunderbird in this case) so you can view it. Usually only binary attachments (images, PDFs, etc.) are encoded, but the whole thing can be, as you discovered.
As to WHY they do it, I really don't know. It may be an attempt to evade spam detecting mechanisms by disguising trigger words among the encoding.
No spammer would ever encrypt their messages, because nobody would be able to read them. That is unless you deliberately submitted your public key to a spammer, so that they can use it to encrypt their spam to your key. Did you?
Thanks for the quick reply.
Here is an example:
Content-Type: text/html; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64
PGRpdiBjbGFzcz0iYTNzIGFpTCBtc2ctNjEwNzQ0MzQ2MjM0NjYyMDA2IiBpZD0iOm9pIj48ZGl2 IGlkPSJhdldCR2QtMjAiPjx1PjwvdT4KCgogICAgCiAgICAKICAgIAogICAgCgo8ZGl2IHN0eWxl PSJtYXJnaW46MDtwYWRkaW5nOjA7YmFja2dyb3VuZC1jb2xvcjojZjNmNWY4O2ZvbnQtZmFtaWx5 OidIZWx2ZXRpY2EgTmV1ZScsSGVsdmV0aWNhLEFyaWFsLHNhbnMtc2VyaWYiPgoKCgo8dGFibGUg
Just to be sure, I compared this to a message I just received from Blue Cross and it showed all the message content in the source code. But in the above sample, the message came from the scammer.
選ばれた解決策
Like I mentioned, this is a bit of the email body that has been encoded to Base64. Not "encrypted." There are many on-line decoders (here's one: https://www.w3schools.com/tools/tool_base64.php ). When you plug your excerpt into it you'll see that it's just a bit of html code that would be part of the email's formatting. There's nothing inherently dangerous in this small bit, but there may be a malicious attachment elsewhere in the message or links to a malicious web site.
Legit senders might encode their entire message, too, so that in of itself isn't a reliable sign of spam. And ALL binary attachments will be encoded for transmission. That's part of the standard email protocols.
この投稿は Lin により に変更されました
The answer is right there:
Content-Transfer-Encoding: base64
So your spam message (or parts of it) are base64 encoded, but not encrypted.
Base64 encoding in email is a method of translating binary data (like images, PDF attachments, or non-English text scripts) into a strict subset of 64 plain ASCII text characters. Under the MIME framework, emails indicate how parts of a message are formatted. By marking an email section header with Content-Transfer-Encoding: base64, the recipient's mail app knows to decode those safe text characters back into the original binary file.
投稿に返信するには あなたのアカウントにログイン する必要があります。まだアカウントをお持ちでなければ、新しい質問を開始 してください。