You don't want to filter for this. This is the standard encoding that
represents any GIF. It is not unique to this spammer, but rather it is
universal. It would be no different than filtering for "image/gif"
Matt
Dave Doherty wrote:
ANYWHERE 30 CONTAINS R0lGODdh1
should do it, no?
----- Original Message ----- From: "Dave Beckstrom" <[EMAIL PROTECTED]>
To: <declude.junkmail@declude.com>
Sent: Wednesday, June 28, 2006 10:57 AM
Subject: RE: [Declude.JunkMail] New spam campaign possibly
We're getting hundreds of those. The image has a constant pattern
starting
with " R0lGODdh1"
Is there a way to make a filter that would look at the data
comprising the
image? I'd like to delete filter based on that.
Here is a snippet:
Content-Type: image/gif;
name="jizuxed.gif"
Content-Transfer-Encoding: base64
Content-ID: <[EMAIL PROTECTED]>
R0lGODdh1wHHAvIAAAQGBcgjJPs5KrOYnPr////++v/4/////SwAAAAA1wHHAgAD/3i63P4w
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
John T
(Lists)
Sent: Wednesday, June 28, 2006 1:44 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] New spam campaign possibly
3 spam's to postmaster accounts, all got low weights, single gif file
attached and from zombie computers.
Only pattern I see is the formatting of the body viewed in plain
text and
HTML and user part of from address is random characters. Actual
wording is
different and no URLs listed.
John T
eServices For You
"Seek, and ye shall find!"
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
