zip only spam

[Chris Yuzik]

Leland J. Steinke wrote:
  > Sorry, "inline" needs to be changed to "attachment" as well.

Leland,

So this then?

full     ZIP_ONLY_SPAM 
/encoding\:\s+7bit(\n?)+[\-0-9]+.{1,40}type\:\s+application\/octet-stream\;.{1,40}name\=.{1,40}\.zip.{1,50}disposition\:\s+attachment\;.{1,40}filename\=.{1,40}\.zip/is

Chris