Image-only spams

[John Hardin]

All:

Okay, the spammers finally started sending these to me, and they are
pretty distictive. Try this:


header     __CTYPE_MULTIPART_MXD Content-Type =~ /multipart\/mixed/i
mimeheader __ANY_TEXT_ATTACH     Content-Type =~ /text\/\w+/i
meta     MIME_IMAGE_ONLY (__CTYPE_MULTIPART_MXD && __ANY_IMAGE_ATTACH && !__ANY_TEXT_ATTACH)
score    MIME_IMAGE_ONLY 2.00
describe MIME_IMAGE_ONLY Image body part but no text body parts


Justin, could you put this in the sandbox please?

Thanks.

--
  John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
  jhardin@...    FALaholic #11174     pgpk -a jhardin@...
  key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
   USMC Rules of Gunfighting #20: The faster you finish the fight,
   the less shot you will get.
-----------------------------------------------------------------------
  Tomorrow: the 64th anniversary of VE day

[Justin Mason]

done.  we need to sort out that committer account so you can put it
there yourself ;)

--j.

On Thu, May 7, 2009 at 17:20, John Hardin <jhardin@...> wrote:

> All:
>
> Okay, the spammers finally started sending these to me, and they are pretty
> distictive. Try this:
>
>
> header     __CTYPE_MULTIPART_MXD Content-Type =~ /multipart\/mixed/i
> mimeheader __ANY_TEXT_ATTACH     Content-Type =~ /text\/\w+/i
> meta     MIME_IMAGE_ONLY (__CTYPE_MULTIPART_MXD && __ANY_IMAGE_ATTACH &&
> !__ANY_TEXT_ATTACH)
> score    MIME_IMAGE_ONLY 2.00
> describe MIME_IMAGE_ONLY Image body part but no text body parts
>
>
> Justin, could you put this in the sandbox please?
>
> Thanks.
>
> --
>  John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
>  jhardin@...    FALaholic #11174     pgpk -a jhardin@...
>  key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
> -----------------------------------------------------------------------
>  USMC Rules of Gunfighting #20: The faster you finish the fight,
>  the less shot you will get.
> -----------------------------------------------------------------------
>  Tomorrow: the 64th anniversary of VE day
>
>

[Charles Gregory]

Sweet! I was trying to puzzle my way around the logic but couldn't figure
this one out. Pretty simple once I see it. THANKS!

- Charles

On Thu, 7 May 2009, John Hardin wrote:

> Okay, the spammers finally started sending these to me, and they are pretty
> distictive. Try this:
>
> header     __CTYPE_MULTIPART_MXD Content-Type =~ /multipart\/mixed/i
> mimeheader __ANY_TEXT_ATTACH     Content-Type =~ /text\/\w+/i
> meta     MIME_IMAGE_ONLY (__CTYPE_MULTIPART_MXD && __ANY_IMAGE_ATTACH &&
> !__ANY_TEXT_ATTACH)
> score    MIME_IMAGE_ONLY 2.00
> describe MIME_IMAGE_ONLY Image body part but no text body parts
>
>
> Justin, could you put this in the sandbox please?
>
> Thanks.
>
> --
>  John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
>  jhardin@...    FALaholic #11174     pgpk -a jhardin@...
>  key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
> -----------------------------------------------------------------------
>   USMC Rules of Gunfighting #20: The faster you finish the fight,
>   the less shot you will get.
> -----------------------------------------------------------------------
>  Tomorrow: the 64th anniversary of VE day
>

[John Hardin]

On Thu, 7 May 2009, Charles Gregory wrote:

> Sweet! I was trying to puzzle my way around the logic but couldn't figure
> this one out. Pretty simple once I see it. THANKS!

Thank me if it works... :)

--
  John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
  jhardin@...    FALaholic #11174     pgpk -a jhardin@...
  key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
   USMC Rules of Gunfighting #6: If you can choose what to bring to a
   gunfight, bring a long gun and a friend with a long gun.
-----------------------------------------------------------------------
  Tomorrow: the 64th anniversary of VE day

[Charles Gregory]

On Thu, 7 May 2009, John Hardin wrote:
> Thank me if it works... :)

Just fired one of my latest image spams through it and it triggered fine.
So until the spammers adapt... THANKS! :)

- Charles

[Bob Proulx]

John Hardin wrote:
> Thank me if it works... :)

It works.  This was exactly what I was asking for too.

Thank you very much!

Bob