discussion on the spamassassin users list about this .<div><br></div><div><a href="http://thread.gmane.org/gmane.mail.spam.spamassassin.general/119193/focus=119196">http://thread.gmane.org/gmane.mail.spam.spamassassin.general/119193/focus=119196</a><br>
<span class="Apple-style-span" style="font-size: 16px; border-collapse: collapse; "><h1 class="ha" style="font-family: arial, sans-serif; font-size: 16px; margin-top: 12px; margin-right: 5px; margin-bottom: 5px; margin-left: 10px; padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; color: rgb(0, 0, 0); background: inherit; border-right: inherit; ">
<span id=":k" class="hP" style="padding-right: 10px; ">"application/octet-stream" Content-Type used to obfuscate terse .RTF spam</span></h1><div><br></div><div>so looks like the bad guys are doing naughty things to get around mime handling...</div>
</span><div><br></div>-- <br>Martin Hepworth<br>Oxford, UK</div><div><br></div><div><br><div class="gmail_quote">2009/5/31 Paul Welsh <span dir="ltr"><<a href="mailto:paul.welsh.3@googlemail.com">paul.welsh.3@googlemail.com</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">Had a few of these today; message containing an RTF attachment of under 1k<br>
and no message body. Rather like the png attachment spam that I started<br>
noticing in earnest a few weeks ago.<br>
<br>
Anyone know of a good spamassassin rule to detect these?<br>
<font color="#888888"><br>
--<br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the website!<br>
</font></blockquote></div><br><br clear="all"><br><br>
</div>