zip only spam

[Chris Yuzik]

Steven Andrews wrote:
> This code (below) is tested and working for me.
> 
> full          ZIP_ONLY_SPAM
> /encoding\:\s+7bit(\n?)+[\-0-9]+.{1,40}type\:\s+application\/octet-strea
> m\;.{1,40}name\=.{1,40}\.zip.{1,50}disposition\:\s+attachment\;.{1,40}fi
> lename\=.{1,40}\.zip/is
> describe      ZIP_ONLY_SPAM       ZIP only Message, no text in message
> body
> score         ZIP_ONLY_SPAM       5.0 

Steven,

I'm using this, but so far not getting any hits.

# ZIP only spam
full     	  ZIP_ONLY_SPAM 
/encoding\:\s+7bit(\n?)+[\-0-9]+.{1,40}type\:\s+application\/octet-stream\;.{1,40}name\=.{1,40}\.zip.{1,50}disposition\:\s+attachment\;.{1,40}filename\=.{1,40}\.zip/is
describe        ZIP_ONLY_SPAM   ZIP only Message, no text in message body
score           ZIP_ONLY_SPAM   3.95

Not sure what I've done wrong.

Chris