I receive quite a few legitimate pdf attachments - half of them are pdf type, the other half is octet-string (but they are usually A4 paper size)
Wolfgang Hamann >> >Here's a new style of PDF spam (recipient email address is munged): >> >> [snip] >> >> > - uses "application/octet-stream" instead of "application/pdf" >> > as the Content-Type >> >> From your sample: >> >> Content-Type: application/octet-stream; name="Message.pdf" >> >> You could match on the "application/octet-steam" and the file >> extension being ".pdf". >> >> Regards, >> -sm >> >>
