zip only spam

[Leland J. Steinke]

Chris Yuzik wrote:
> 
> I'm using this, but so far not getting any hits.

I am finding that the spammers are working around this pattern with an 
empty text/plain body, a text/html body with a bunch of markup around 
" ", and then the actual ZIP.  SA3.2.2 is catching the bulk of 
these with its built-in rules.  You might have to look at the actual 
message source to see where it is differing from what the ZIP_ONLY_SPAM 
rule is expecting.


Leland