Nick, very good method. I have added that to my configuration as well now.
----- Original Message ----- From: "Nick Hayer" <[EMAIL PROTECTED]> To: "Message Sniffer Community" <[email protected]> Sent: Tuesday, June 06, 2006 10:05 AM Subject: Re: [sniffer]Numeric spam topic change to png stock spam > Hi Markus - > > Markus Gufler wrote: > > >There is also another type of spam (stock spam now with attached png image) > >this morning passing our filters. > > > I am catching these fairly easily - > a combo filter - > #combo-stockspammer-png.txt > SKIPIFWEIGHT 26 > TESTSFAILED END NOTCONTAINS EXTERNAL.REGEX.STOCKSPAMMER.BODY > BODY 5 CONTAINS Content-Type: image/png; > # > The body regex is this: > src="cid:[a-z0-9]{12}\$[a-z0-9]{8}\$[a-z0-9]{8}@ > > -Nick > > > > > > > > ############################################################# > This message is sent to you because you are subscribed to > the mailing list <[email protected]>. > To unsubscribe, E-mail to: <[EMAIL PROTECTED]> > To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> > To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> > Send administrative queries to <[EMAIL PROTECTED]> > ############################################################# This message is sent to you because you are subscribed to the mailing list <[email protected]>. To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]>
