The stuff after the CID argument is the value of the CID that is
embedded. The CID name must of course reference whatever the
attachment's CID is. I would imagine that the name can be any string of
ASCII characters.
If you are going after the stock spammer, I have a filter for this that
works with Declude, and also with Alligate in front of Declude. See the
attachment.
Matt
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
# STOCKSPAMMER v1.0.1
# Qualifying hit for AddrSpace when behind Alligate or CMDSPACE with just
Declude.
# Swap comments when not behind Alligate.
HEADERS END NOTCONTAINS X-Alligate-AddrSpace: Failed
# TESTSFAILED END NOTCONTAINS CMDSPACE
# Qualifying hits for CID linked image
BODY END NOTCONTAINS "cid:
BODY END NOTCONTAINS Content-Type: image/
# Stock Spammer requirements.
HEADERS END NOTCONTAINS Content-Type: multipart/related;
HEADERS END NOTCONTAINS X-Mailer: Microsoft Outlook
HEADERS END NOTCONTAINS From: "
HEADERS END NOTCONTAINS To: <
# Protect from the potential of FP's in personal E-mail which may contain CID
linked images.
HEADERS END CONTAINS MailEnable
HEADERS END CONTAINS SurfControl
HEADERS END CONTAINS StormMail
HEADERS END CONTAINS InterScan VirusWall
HEADERS END CONTAINS MailMax
# Forged Header patterns.
HEADERS 0 CONTAINS with SMTP id
HEADERS 0 CONTAINS Received: (qmail
HEADERS 0 CONTAINS with smtp (Exim
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
