> -----Original Message-----
> From: John D. Hardin [mailto:[EMAIL PROTECTED]
>
> On Thu, 15 Jun 2006, Matt wrote:
>
> > It seems the spammers have gotten smart to the fact that we were
> > filtering for one large image and no text... now what I am
> seeing is
> > that the spammers are sending many small images inline with the
> > e-mails! But, I have yet to see a way to filter against this.
> > Any thoughts?
>
> This is yet another argument for match counts in SA rules. It
> would be useful to score (say) .10 per image attachment after
> the first two or three...
>
>
I am seeing this too. It's the only spam I get now. Stocks with GIF images
inline.
How annoying. I bumped up SARE_GIF_ATTACH to 4.75 points but that's not enough
to kill it.
Anyone have a good rule for this??
Thanks,
Eric
(Headers & Score follow)
X-Spam-Score: 4.75
X-Spam-Level: ****
X-Spam-Status: No, score=4.75 tagged_above=-100 required=6.1
tests=[SARE_GIF_ATTACH=4.75]
X-Greylist: Passed host: 86.216.157.231 whitelisted
Received: from AMarseille-252-1-134-231.w86-216.abo.wanadoo.fr
(AMarseille-252-1-134-231.w86-216.abo.wanadoo.fr [86.216.157.231])
Received: from [86.216.193.205] (helo=hqhyu.lr)
by AMarseille-252-1-134-231.w86-216.abo.wanadoo.fr with smtp (Exim
4.43)
id 1Fr0xd-0004La-Gb; Fri, 16 Jun 2006 01:09:13 +0200
Message-ID: <[EMAIL PROTECTED]>
From: "Tony Ratliff" <[EMAIL PROTECTED]>
Subject: beet debilitate
Date: Fri, 16 Jun 2006 01:01:09 +0200
MIME-Version: 1.0
Content-Type: multipart/related;
type="multipart/alternative";
boundary="----=_NextPart_000_0017_01C690E0.E33C46F6"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2670
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670
Return-Path: [EMAIL PROTECTED]
X-OriginalArrivalTime: 15 Jun 2006 23:05:15.0410 (UTC)
FILETIME=[29B71720:01C690D0]
------=_NextPart_000_0017_01C690E0.E33C46F6
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_0018_01C690E0.E33C470D"
------=_NextPart_001_0018_01C690E0.E33C470D
Content-Type: text/plain;
charset="windows-1252"
Content-Transfer-Encoding: quoted-printable
------=_NextPart_001_0018_01C690E0.E33C470D
Content-Type: text/html;
charset="windows-1252"
Content-Transfer-Encoding: quoted-printable
------=_NextPart_001_0018_01C690E0.E33C470D--
------=_NextPart_000_0017_01C690E0.E33C46F6
Content-Type: image/gif;
name="irritate.gif"
Content-Transfer-Encoding: base64
Content-ID: <[EMAIL PROTECTED]>
------=_NextPart_000_0017_01C690E0.E33C46F6
Content-Type: image/gif;
name="bowl.gif"
Content-Transfer-Encoding: base64
Content-ID: <[EMAIL PROTECTED]>
------=_NextPart_000_0017_01C690E0.E33C46F6
Content-Type: image/gif;
name="nationalize.gif"
Content-Transfer-Encoding: base64
Content-ID: <[EMAIL PROTECTED]>
------=_NextPart_000_0017_01C690E0.E33C46F6
Content-Type: image/gif;
name="nationalism.gif"
Content-Transfer-Encoding: base64
Content-ID: <[EMAIL PROTECTED]>
------=_NextPart_000_0017_01C690E0.E33C46F6
Content-Type: image/gif;
name="formally.gif"
Content-Transfer-Encoding: base64
Content-ID: <[EMAIL PROTECTED]>
------=_NextPart_000_0017_01C690E0.E33C46F6
Content-Type: image/gif;
name="upwards.gif"
Content-Transfer-Encoding: base64
Content-ID: <[EMAIL PROTECTED]>
------=_NextPart_000_0017_01C690E0.E33C46F6
Content-Type: image/gif;
name="heartbreaking.gif"
Content-Transfer-Encoding: base64
Content-ID: <[EMAIL PROTECTED]>
------=_NextPart_000_0017_01C690E0.E33C46F6
Content-Type: image/gif;
name="smear.gif"
Content-Transfer-Encoding: base64
Content-ID: <[EMAIL PROTECTED]>
------=_NextPart_000_0017_01C690E0.E33C46F6
Content-Type: image/gif;
name="titter.gif"
Content-Transfer-Encoding: base64
Content-ID: <[EMAIL PROTECTED]>
------=_NextPart_000_0017_01C690E0.E33C46F6
Content-Type: image/gif;
name="connivance.gif"
Content-Transfer-Encoding: base64
Content-ID: <[EMAIL PROTECTED]>
