How are you catching these spam

[Anthony Cartmell]

> The two attached png's are samples of what we are getting as spam. The
> message has a random subject and the attachment name apears to be random
> with nothing in the body of the message.

I've had some success with a borrowed rule, modified to check for PNG  
images only (as they all seem to be in this format at the moment):

header          __CTYPE_MULTIPART_MXD           Content-Type =~  
/multipart\/mixed/i
mimeheader      __ANY_TEXT_ATTACH               Content-Type =~  
/text\/\w+/i
mimeheader      __MIME_PNG_ATTACH               Content-Type =~  
/image\/png/i
meta            MIME_PNG_IMAGE_ONLY          (__CTYPE_MULTIPART_MXD &&  
__MIME_PNG_ATTACH && !__ANY_TEXT_ATTACH)
score           MIME_PNG_MAGE_ONLY          4.01
describe        MIME_PNG_IMAGE_ONLY          PNG format image body part  
and no text body parts

HTH,

Anthony
-- 
www.fonant.com - Quality web sites