3 spam's to postmaster accounts, all got low weights, single gif file
attached and from zombie computers.
Only pattern I see is the formatting of the body viewed in plain text and
HTML and user part of from address is random characters. Actual wording is
different and no URLs listed.
John T
We're getting hundreds of those. The image has a constant pattern starting
with R0lGODdh1
Is there a way to make a filter that would look at the data comprising the
image? I'd like to delete filter based on that.
Here is a snippet:
Content-Type: image/gif;
name=jizuxed.gif
ANYWHERE 30 CONTAINS R0lGODdh1
should do it, no?
- Original Message -
From: Dave Beckstrom [EMAIL PROTECTED]
To: declude.junkmail@declude.com
Sent: Wednesday, June 28, 2006 10:57 AM
Subject: RE: [Declude.JunkMail] New spam campaign possibly
We're getting hundreds of those. The
Is this Broken spamware? Ive
gotten a few of these over the past few days.
From: LEWIS MUSASIKE
[mailto:[EMAIL PROTECTED]
Sent: Wednesday, June 28, 2006
4:33 AM
To: [EMAIL PROTECTED]
Subject: [SPAM]I must apologize
for this unsolicited nature of my email. I am Mr. Lewis
You don't want to filter for this. This is the standard encoding that
represents any GIF. It is not unique to this spammer, but rather it is
universal. It would be no different than filtering for image/gif
Matt
Dave Doherty wrote:
ANYWHERE 30 CONTAINS R0lGODdh1
should do it, no?
It's just an idiot trying to spam.
They are using new E-mail address announcement apps to push their
messages out, and this guy seems to just be pasting all of his content
into the subject. He could be using a program that exploits multiple
sites, and this one may not provide for adding
