I've seen now what type of message you mean. It was already discussed in the last two weeks under the "cbl"-thread. Seems that the spammer this time use a very simple way to send the spam with the black borders. The body contains nothing else then
<img src=cid:[random-string]> The message is always failing CMDSPACE and in this case also SNIFFER-GENERAL Markus > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Dave > Beckstrom > Sent: Sunday, December 18, 2005 7:02 PM > To: [email protected] > Subject: [Declude.JunkMail] Nasty Spammer > > I'm getting rather irritated with this one. We're getting > spam which contains only one line: > > <img src=cid:1dd0fa2ddee584b7e4937d9e77a06d69> > > > Is there some way to make a filter where if "img src=cid" is > found on the first line then set a weight? > > No legitimate email should ever contain only the one statement. > > > > --- > [This E-mail scanned for viruses by Declude Virus] > > > --- > [This E-mail was scanned for viruses by Declude EVA www.declude.com] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be > found at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
