On Tue, 2 Jun 2009, Jean-Paul Natola wrote:
ftp://ftp.fcimail.org/IT/SA_Sample/message.txt
Yep, the rules below will hit on that message.
-----Original Message-----
From: John Hardin [mailto:jhar...@impsec.org]
Sent: Tuesday, June 02, 2009 11:18 AM
To: SpamAssassin Users List
Subject: Re: word doc spam
On Tue, 2 Jun 2009, Dave Walker wrote:
John Hardin wrote:
On Tue, 2 Jun 2009, Jean-Paul Natola wrote:
Is there a rule to catch these messages with no body and a 550 bite
word attachment?
Can you post a sample somewhere for us?
Hi,
I assume he means the recent surge in "rtf" attachment spam. I've posted
two examples:
http://spam.daviey.com/rtfspam.txt
http://spam.daviey.com/rtfspam1.txt
The recent no-text-parts rules should catch that. To recap:
header __CTYPE_MULTIPART_ANY Content-Type =~ /multipart\/\w/i
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __ANY_TEXT_ATTACH Content-Type =~ /text\/\w+/i
meta MIME_NO_TEXT (__CTYPE_MULTIPART_ANY && !__ANY_TEXT_ATTACH)
score MIME_NO_TEXT 2.00
describe MIME_NO_TEXT No text body parts
endif
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
It is not the place of government to make right every tragedy and
woe that befalls every resident of the nation.
-----------------------------------------------------------------------
4 days until the 65th anniversary of D-Day
