« Return to Thread: Image-only spams

Image-only spams

by John Hardin :: Rate this Message:

| View in Thread

All:

Okay, the spammers finally started sending these to me, and they are
pretty distictive. Try this:


header     __CTYPE_MULTIPART_MXD Content-Type =~ /multipart\/mixed/i
mimeheader __ANY_TEXT_ATTACH     Content-Type =~ /text\/\w+/i
meta     MIME_IMAGE_ONLY (__CTYPE_MULTIPART_MXD && __ANY_IMAGE_ATTACH && !__ANY_TEXT_ATTACH)
score    MIME_IMAGE_ONLY 2.00
describe MIME_IMAGE_ONLY Image body part but no text body parts


Justin, could you put this in the sandbox please?

Thanks.

--
  John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
  jhardin@...    FALaholic #11174     pgpk -a jhardin@...
  key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
   USMC Rules of Gunfighting #20: The faster you finish the fight,
   the less shot you will get.
-----------------------------------------------------------------------
  Tomorrow: the 64th anniversary of VE day

 « Return to Thread: Image-only spams