ssion...anyone? Bueller?
Try:
body URI_CID_PIC/\bcid\:\S+\.(?:jpg|gif)\b/
Since this specific spammer is *always* using cid:pic.gif, you could
probably make it more specific.
Works for me.
--
Jay Swackhamer <[EMAIL PROTECTED]>
Nebularis Inc <http://www.nebularis
of differing comments. It might be better to do an
eval rule for this.
--
Jay Swackhamer <[EMAIL PROTECTED]>
Nebularis Inc. <http://nebularis.com>
Ottawa, ON tel: 613-843-9358 ext 262 fax: 613-825-5960
---
This sf.net email is
On Sat, 29 Jun 2002, Bart Schaefer wrote:
> My DSL ISP (aka "the phone company") now offers Brightmail-based spam
> filtering. It caught 8 of the 12 spam messages I've received since it
> was activated (SA caught all 4 of the rest, plus an Outpost.com mailer
> that scored 14.5 -- I'd add them to
them actually do exist! Someone else is getting your spam. :-p
> Nowadays, a better trick is to mix in a few "real" addresses, which
> feed directly to "spamassassin -r". Assuming the spammers spam them
> as part of a mass run, they'll add themselves imme
are a bunch of these happening.
I blacklist their mail-from address ([EMAIL PROTECTED]/droc.com) and
review them manually, then warn the customer who these guys are, and
advise them to do a charge-back.
--
Jay Swackhamer <[EMAIL PROTECTED]>
MailPolice Spam&Virus El
