This filter will work for targeting CMDSPACE with a gif attachment.
You might want to
SKIPIFWEIGHT 315
STOPATFIRSTHIT
BODY END NOTCONTAINS Content-Type: image/gif
TESTSFAILED END NOTCONTAINS CMDSPACE
BODY 100 CONTAINS img src=3Dcid:
BODY 100 CONTAINS src=3D"cid:
BODY 100 CONTAINS src="cid:
BODY 100 CONTAINS src=3D"= cid:
----- Original Message -----
From: "Karl Hentschel" <[EMAIL PROTECTED]>
To: <Declude.JunkMail@declude.com>
Sent: Monday, November 06, 2006 12:58 PM
Subject: [Declude.JunkMail] Spam not being caught
We have been getting quite a bit of SPAM, usually about stocks that is not
being caught by Declude. I have the newest version of Declude, updated
filter files from Imail, invURIBL, trial version of Sniffer. These emails
are typically only failing cmdspace and helobogus, not enough to get
blocked. Has anyone had any success blocking these recent floods of
emails?
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
