35

I recently got an e-mail with the title

=?utf-8?B? 8J+QtiBZb3UncmUgYSBzdHJvbmcgY2FuZGlkYXRlIGZvciBvdXIgZnV0dXJlLCBQZXRlciDwn4e6 8J+HuA==?=

Thinking it might be malware, I ran a check with Malwarebytes, and it came up clean. Is there any legitimate reason for the title to be a nonsensical string of characters?

0

2 Answers 2

82

What you have is some header text encoded with a failed attempt at RFC 2047.

RFC 2047 is the standard governing embedding non-ASCII characters in email headers, and it says that headers which do not comply exactly with the RFC 2047 standard should be displayed as-is, rather than decoding being attempted. So your email software is seeing the bad header and displaying it “correctly” (as required by the standard).

No mainstream software flouts RFC 2047 so badly as that, so it's probably coming from some dodgy bulk mailing software. The software is making "encoded words" too long (line length limit 76), which is forbidden (RFC 2047 says “MUST NOT”).

Despite being over-long it can be decoded manually; it looks like some sort of recruiter spam:

🐶 You're a strong candidate for our future, Peter 🇺🇸
7
  • 15
    @LightnessRacesinOrbit That's assuming the spammers are accurate. Apparently, my first name is often "FirstName".
    – TripeHound
    Jun 17, 2016 at 11:36
  • 1
    @TripeHound: Mine are almost always accurate. Jun 17, 2016 at 12:32
  • 5
    @vaxquis: most typefaces render it as thirteen horizontal stripes alternating red and white; in the canton, 50 white stars of alternating numbers of six and five per row on a blue field. Jun 17, 2016 at 13:29
  • 4
    @JacobKrall aaah, emojipedia.org/flag-for-united-states ... on my PC, it's just a US glyph.
    – user201265
    Jun 17, 2016 at 13:40
  • 1
    @vaxquis same here; I think it's something to do with the user agent. On iOS, I see the US flag, but in Firefox I see the digraph US. Jun 17, 2016 at 13:43
21

It is a base64 string, a way of encoding text or data so it can be sent via 7-bit ASCII text supported by emails.

It would appear that your email client does not support base64 in the subject line.

Poking the text

8J+QtiBZb3UncmUgYSBzdHJvbmcgY2FuZGlkYXRlIGZvciBvdXIgZnV0dXJlLCBQZXRlciDwn4e6 8J+HuA==?=

Through base64decode shows the string below. This is the body of the string minus the utf-8 header.

🐶 You're a strong candidate for our future, Peter 🇺🇸

1
  • 3
    “🐶 You're a strong candidate for our future, Peter 🇺🇸” Seems legit! Jun 19, 2016 at 4:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .