So the past few weeks we have been trying to cut back on the amount of spam reaching our users in our organization. We have been successful in implementing hard filtering rules like if an email subject or body contains "my bitcoin address" that usually means the email is a spam email along the lines of "I hacked your email now send me bitcoins". This rule has been good but some are still getting through. Upon inspecting the raw of the emails that make it through we see that they are using some utf-8 encoding to escape the filter.
Here is an example:
=E2=80=8BMy=E2=80=8B b=E2=80=8Bit=E2=80=8Bco=E2=80=8Bin=E2=80=8B a=E2=80=8Bdd=E2=80=8Bre=E2=80=8Bss=E2=80=8B (=E2=80=8BBT=E2=80=8BC =E2=80=8BWa=E2=80=8Bll=E2=80=8Bet= =E2=80=8B) =E2=80=8Bis
But decodes to:
My bitcoin address (BTC Wallet) is
Does anyone have experience in defeating this form of obfuscation? Specifically using Exchange 2010 filtering rules to help defeat this.