zip only spam

Chris Yuzik itdept at fractalweb.com
Thu Aug 2 19:53:42 IST 2007


Leland J. Steinke wrote:

>> # ZIP only spam
>> full     ZIP_ONLY_SPAM 
>> /encoding\:\s+7bit(\n?)+[\-0-9]+.{1,40}type\:\s+application\/zip\;.{1,40}name\=.{1,40}\.zip.{1,50}disposition\:\s+inline\;.{1,40}filename\=.{1,40}\.zip/is 
> 
> 
> s/zip/octet-stream/

I'm using the following rule, but getting no joy:
full     ZIP_ONLY_SPAM 
/encoding\:\s+7bit(\n?)+[\-0-9]+.{1,40}type\:\s+application\/octet-stream\;.{1,40}name\=.{1,40}\.zip.{1,50}disposition\:\s+inline\;.{1,40}filename\=.{1,40}\.zip/is

I have a similar rule which does trigger for PDF only spam and works 
fine. What am I doing wrong?

Chris


More information about the MailScanner mailing list