Re: application/octet-stream Content-Type used to obfuscate terse .RTF spam

2009-06-02 Thread Adam Katz
Matus UHLAR - fantomas wrote: http://puffin.net\software\spam\samples\0005_body.txt Address Not Found puffin.net\software\spam\samples\0005_body.txt could not be found. Please check the name and try again. Did nobody ever told you that URL directories are separated by slashes, not

Re: application/octet-stream Content-Type used to obfuscate terse .RTF spam

2009-06-01 Thread Bob Proulx
John Hardin wrote: Does this catch it? mimeheader __UNSPEC_BINARY_ATTACH Content-Type =~ /application\/octet-stream/i meta MIME_BINARY_ONLY (__CTYPE_MULTIPART_MXD __UNSPEC_BINARY_ATTACH !__ANY_TEXT_ATTACH) scoreMIME_BINARY_ONLY 2.00 describe MIME_BINARY_ONLY Unspecified

Re: application/octet-stream Content-Type used to obfuscate terse .RTF spam

2009-06-01 Thread Matus UHLAR - fantomas
On 31.05.09 21:25, Chip M. wrote: Mildly redacted sample posted here: http://puffin.net\software\spam\samples\0005_rtf.txt and the plain body, after decoding to plain text (purely for convenience): http://puffin.net\software\spam\samples\0005_body.txt Address Not Found

Re: application/octet-stream Content-Type used to obfuscate terse .RTF spam

2009-06-01 Thread John Hardin
On Mon, 1 Jun 2009, Bob Proulx wrote: However playing wack-a-mole with each new type isn't productive. Perhaps this following, completely untested, would be the better way to go. Just look for any multipart message that doesn't have any text parts. That actually sounds best to me. -- John

Re: application/octet-stream Content-Type used to obfuscate terse .RTF spam

2009-05-31 Thread John Hardin
On Sun, 31 May 2009, Chip M. wrote: All had a main header Content-Type of multipart/mixed with exactly one actual Part with a Content-Type of application/octet-stream containing a name with the file extension .rtf. Does this catch it? mimeheader __UNSPEC_BINARY_ATTACH Content-Type =~

Re: application/octet-stream Content-Type used to obfuscate terse .RTF spam

2009-05-31 Thread Karsten Bräckelmann
On Sun, 2009-05-31 at 14:55 -0700, John Hardin wrote: On Sun, 31 May 2009, Chip M. wrote: All had a main header Content-Type of multipart/mixed with exactly one actual Part with a Content-Type of application/octet-stream containing a name with the file extension .rtf. Does this catch