word doc spam

[Jean-Paul Natola]

Hi all,

Is there a rule to catch these  messages  with no body and a 550 bite word
attachment?

thx


The only rule its triggering is the 
RCVD_IN_SORBS_DUL      RBL: SORBS: sent directly from dynamic IP address