> >> Rob Mangiafico wrote: > >> > Anyone else find this to be a good rule to catch these > image stock spams > >> > without too much collateral damage? > >> > > >> > > >> After writing this I did some checks on the SA public > corpus. The rule > >> didn't hit on any of the hard ham. It didn't hit much of > the spam either > >> since very little of that is image spam. > >> > >> Regarding SARE it has SARE_GIF_ATTACH which matches on any > email that > >> has an attached image. My rule only matches on email that has an > >> attached image that is referenced in the HTML. > > Hi, > > a friend of mine is using outlook "stationary" with a logo. > This would hit the rule ... I am not sure whether many > senders do that, however
Yeah, much to my amazement, many of our users do this as well. Bret
