ANYWHERE 30 CONTAINS R0lGODdh1
should do it, no?
----- Original Message -----
From: "Dave Beckstrom" <[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Wednesday, June 28, 2006 10:57 AM
Subject: RE: [Declude.JunkMail] New spam campaign possibly
We're getting hundreds of those. The image has a constant pattern
starting
with " R0lGODdh1"
Is there a way to make a filter that would look at the data comprising the
image? I'd like to delete filter based on that.
Here is a snippet:
Content-Type: image/gif;
name="jizuxed.gif"
Content-Transfer-Encoding: base64
Content-ID: <[EMAIL PROTECTED]>
R0lGODdh1wHHAvIAAAQGBcgjJPs5KrOYnPr////++v/4/////SwAAAAA1wHHAgAD/3i63P4w
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John
T
(Lists)
Sent: Wednesday, June 28, 2006 1:44 AM
To: [email protected]
Subject: [Declude.JunkMail] New spam campaign possibly
3 spam's to postmaster accounts, all got low weights, single gif file
attached and from zombie computers.
Only pattern I see is the formatting of the body viewed in plain text and
HTML and user part of from address is random characters. Actual wording
is
different and no URLs listed.
John T
eServices For You
"Seek, and ye shall find!"
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
