zip only spam

[Steven Andrews]

This code (below) is tested and working for me.

full          ZIP_ONLY_SPAM
/encoding\:\s+7bit(\n?)+[\-0-9]+.{1,40}type\:\s+application\/octet-strea
m\;.{1,40}name\=.{1,40}\.zip.{1,50}disposition\:\s+attachment\;.{1,40}fi
lename\=.{1,40}\.zip/is
describe      ZIP_ONLY_SPAM       ZIP only Message, no text in message
body
score         ZIP_ONLY_SPAM       5.0 

-----Original Message-----
From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Chris
Yuzik
Sent: Tuesday, August 07, 2007 12:10 PM
To: MailScanner discussion
Subject: Re: zip only spam

Leland J. Steinke wrote:
  > Sorry, "inline" needs to be changed to "attachment" as well.

Leland,

So this then?

full     ZIP_ONLY_SPAM 
/encoding\:\s+7bit(\n?)+[\-0-9]+.{1,40}type\:\s+application\/octet-strea
m\;.{1,40}name\=.{1,40}\.zip.{1,50}disposition\:\s+attachment\;.{1,40}fi
lename\=.{1,40}\.zip/is

Chris

--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website!