On Fri, 2009-05-08 at 09:27 -0400, Randy wrote: > Also they changed the name > and image ( slightly ) . Now the image is "Gibas.png" or at least, they > are using this too. > They're using a variety of names these days, but all following the fprm you quote: PersonalName.png. I've decoupled my image matching to give three rules (fake DSLR name, NONAME image, and any PNG) but these are always combined with some other rule that triggers on (unlikely || medspam || sex) words in either Subject line or the body.
BTW, all my image spam is coming via SourceForge mailing lists, so that goes in the meta as well. The mail list carrying most of this junk usually appends a text/plain advert and always appends a text/plain list contact details, so (sadly) the no-text rule prevents SA from detecting this type of image spam. Martin
