Problem with rules to catch inline images

Kevin Peuhkurinen 1 Feb 2005 13:21:23 -0000

Hey folks. I'm seeing a fair bit of spam getting through with embedded GIF images, a slightly redacted version being pasted into the bottom of this email. I'm trying to write a rule to catch embedded GIFs, but it just doesn't seem to work. I've tried the following:

full                KP_GIF2         /name=".{1,8}\.GIF"/i
score             KP_GIF2         0.1

and

full              KP_GIF3         /Content-Type\: image\/gif\;/i
score           KP_GIF3         0.1

Neither of these are firing.   Any ideas?

Thanks,
Kevin

From - Tue Feb 1 07:26:30 2005 X-Account-Key: account1 X-UIDL: AAAK7NqAAAgtpma5Rl/L1ikghkc3s3NF X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Received: from jedi.hepcoe.com ([XXXXXXXXXXX]) by exch-prod.hepcoe.com with Microsoft SMTPSVC(6.0.3790.0); Tue, 1 Feb 2005 05:06:35 -0500 Received: from localhost ([127.0.0.1]) by jedi.hepcoe.com with esmtp (Exim 4.42) id 1Cvuvb-0006ya-BD for [EMAIL PROTECTED]; Tue, 01 Feb 2005 05:06:35 -0500 Received: from jedi.hepcoe.com ([127.0.0.1]) by localhost (jedi [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 26687-07 for <[EMAIL PROTECTED]>; Tue, 1 Feb 2005 05:06:34 -0500 (EST) Received: from newfirewall.hepcoe.com ([XXXXXXXXXXX] helo=fw-prod.hepcoe.com) by jedi.hepcoe.com with smtp (Exim 4.42) id 1CvuvB-0006x1-3P for [EMAIL PROTECTED]; Tue, 01 Feb 2005 05:06:09 -0500 Received: from smtp01.tidc.telus.com ([66.203.199.217]) by fw-prod.hepcoe.com; Tue, 01 Feb 2005 05:06:03 -0500 (Eastern Standard Time) Received: (qmail 21437 invoked from network); 1 Feb 2005 10:06:01 -0000 Received: from unknown (HELO 207.219.111.25) (61.174.186.211) by 0 with SMTP; 1 Feb 2005 10:06:01 -0000 Received: from mdnwjn.probe.net (HELO oengs64) ([159.133.187.140]) (envelope-sender <[EMAIL PROTECTED]>) by ebwze.probe.net (Postfix) with smtp for <[EMAIL PROTECTED]>; Tue, 01 Feb 2005 04:02:19 -0600 Message-ID: <[EMAIL PROTECTED]> From: "Estelle Hightower" <[EMAIL PROTECTED]> To: "Kennedy" <[EMAIL PROTECTED]> Subject: Re: Clinoril 500/80mg repertory Date: Tue, 01 Feb 2005 04:02:19 -0600 MIME-Version: 1.0 To: [EMAIL PROTECTED] Subject: mild Lortab may make you drowsy Content-Type: multipart/related; boundary="------------011109050304050804020004" X-Spam-Status: No, hits=3.278 tagged_above=-5 required=3.5 tests=BAYES_01, FVGT_m_MULTI_ODD2, FVGT_m_MULTI_ODD3, HTML_MESSAGE, RCVD_IN_NJABL_DUL, RCVD_IN_SORBS_DUL, RCVD_NUMERIC_HELO X-Spam-Level: *** Return-Path: [EMAIL PROTECTED] X-OriginalArrivalTime: 01 Feb 2005 10:06:35.0957 (UTC) FILETIME=[B69F0E50:01C50845]


This is a multi-part message in MIME format.

--------------011109050304050804020004
Content-Type: multipart/alternative;
       boundary="------------010902060907010108080001"

--------------010902060907010108080001
Content-Type: text/plain;
       charset="windows-1251"
Content-Transfer-Encoding: 7bit

him, said with a smile, You should have moved your master not to
exclaimed, O foolish creature that I am! For the sake of a
A SICK STAG lay down in a quiet corner of its pasture ground.
then zoomed off to the airport.  I believe he was cutting it rather close.

--------------010902060907010108080001
Content-Type: text/html;
        charset="windows-1251"
Content-Transfer-Encoding: 7Bit

<HTML><HEAD> <META http-equiv=Content-Type content="text/html; charset=windows-1251"> </HEAD> <BODY><A href="http://gqstprfwc.annualize6lesser.com/?TM4eihDDf0MJJtQ";>

<IMG SRC="cid:vlsnxke_vsnales_joufbqo"; border="0" ALT=""></A>stores were closing up, and I knew Burger King would remain open for a Think of past tradesmen tradesperson who no longer have a place means being pushed and pulled. But I would rather be respected shop getting fixed by Apple, and one was my mom's computer, 3,000 each other and with computers, and has drastically changed the himself, and by a wily stratagem succeeded. How handsome is the faults. Hence it is that men are quick to see the faults of valuable commodity information that will keep them ahead of the expressions. For instance, if we were to look at a painting on a connected to the same stream of thought, there is room for when occasion called him one day into the city, he left the sheep integration, what will be the dominant culture adapted by all? experienced before. In their desire to retain that freedom from their reptilian THE PIGEONS, terrified by the appearance of a Kite, called upon case of special needs children those with learning disabilities discover if the Cat in her change of shape had also altered her The computer is a tool created by the scientist and then character is qualified. If no combination of the present scores interests you, water sprinklers running, ka chick, ka chick, ka chik. I realized I was in a Once you've passed all of these obstacles and reached your destination, you service; for when the gold was there, you had it not, as you did are suddenly the saviors of the souls of the aliens. But at least it is a way Excess of information the latest news coming straight from What free trade agreements do for Global companies and there methods would have kept beyond me. The only disadvantage, was Arranging to meet elsewhere should be done with the utmost care. Parking entertainment, said in the joy of his heart, How glad I am that to another. In most cases the cyberart will be presented to the much iTunes music that burning it to CD and re ripping it and symbols would immediately signify fantasy. Artists will have to wretched little sluggard! what shall I do to you? While I am many a trap and snare, observed from a safe distance the trick of puzzle is simple: Each letter in the encoded document represents an unencoded gun at people who were chasing me, but the gun wouldn't work right. Finally guessing game which will reduce the risks for patients. Virtual are a production of very precise and clean final drawings. These the town really is. If each of your characters in a party of six is at the Castle HillStone is the home of Lord Slayer. Slayer is a fanatic about hunting, Modern man is the victim of the very instruments he values

</FONT></p>
</BODY>
</HTML>


--------------010902060907010108080001--

--------------011109050304050804020004
Content-Type: image/gif;
    name="Xvctxl.GIF"
Content-Transfer-Encoding: base64
Content-ID: <vlsnxke_vsnales_joufbqo>

R0lGODlhFQHYAPcAAAAAAIAAAACAAICAAAAAgIAAgACAgICAgMDAwP8AAAD/AP//AAAA//8A/wD/
/////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMwAAZgAAmQAAzAAA/wAzAAAzMwAzZgAzmQAzzAAz/wBm
AABmMwBmZgBmmQBmzABm/wCZAACZMwCZZgCZmQCZzACZ/wDMAADMMwDMZgDMmQDMzADM/wD/AAD/
MwD/ZgD/mQD/zAD//zMAADMAMzMAZjMAmTMAzDMA/zMzADMzMzMzZjMzmTMzzDMz/zNmADNmMzNm
ZjNmmTNmzDNm/zOZADOZMzOZZjOZmTOZzDOZ/zPMADPMMzPMZjPMmTPMzDPM/zP/ADP/MzP/ZjP/
mTP/zDP//2YAAGYAM2YAZmYAmWYAzGYA/2YzAGYzM2YzZmYzmWYzzGYz/2ZmAGZmM2ZmZmZmmWZm
zGZm/2aZAGaZM2aZZmaZmWaZzGaZ/2bMAGbMM2bMZmbMmWbMzGbM/2b/AGb/M2b/Zmb/mWb/zGb/
/5kAAJkAM5kAZpkAmZkAzJkA/5kzAJkzM5kzZpkzmZkzzJkz/5lmAJlmM5lmZplmmZlmzJlm/5mZ
AJmZM5mZZpmZmZmZzJmZ/5nMAJnMM5nMZpnMmZnMzJnM/5n/AJn/M5n/Zpn/mZn/zJn//8wAAMwA
M8wAZswAmcwAzMwA/8wzAMwzM8wzZswzmcwzzMwz/8xmAMxmM8xmZsxmmcxmzMxm/8yZAMyZM8yZ
ZsyZmcyZzMyZ/8zMAMzMM8zMZszMmczMzMzM/8z/AMz/M8z/Zsz/mcz/zMz///8AAP8AM/8AZv8A
mf8AzP8A//8zAP8zM/8zZv8zmf8zzP8z//9mAP9mM/9mZv9mmf9mzP9m//+ZAP+ZM/+ZZv+Zmf+Z
zP+Z///MAP/MM//MZv/Mmf/MzP/M////AP//M///Zv//mf//zP///ywAAAAAFQHYAAAI/wAfCBxI
sKDBgwgTKlzIsKHDhxAjSpxIsaLFixgzatzIsaPHjyBDihxJsqTJkyhTqlzJsqXLlzBjypxJs6bN
ggAAEMwpMKdPnQ9+Ah3486bRo0gn8iQKdOjOpz2hJp1KtarOpkGjGnSatWvVr2CRXo2KdStOrWHT
qo05NmtToWjRFl1Lt27Jt1q5xvUq1a7fvxnxdtXLt/BewIgTO9Rb9izRx5AVS56MkHFPuEHnMl1K
ubPnz6BDix5NurTp06hTq17NurXr17Bjy55N+2i/27hz697Nu7fv38CDCx9OvLjx48iTK1+OvCDz
59CjS59Ovbp16s6va4cOQHj37du/f/8HT338bvPBs9/ujh497pzv3ft2LxT+cfm86ft8T964UOD4
Tbdff+udl5t56vXDXnz42adggAb2BmFwE/Kn23jiEUiceRBWyByGGtJ3YG7Z1TdifgqmiKGDD7I3
4IUjwgfiejIO+GKLIhaI44EOurjjjUDaN+OJFrZoYYY6GlmgkCwmqeOQL/r4U5FT7mglggTxl6OB
CyKZ4pdFRkgjlU6COeOQZJoZYY9pnngmmEQ+eaScdH7JpoQwqqnnnXYm6aWXcKq3YJ5r1ikeh/PF
eSaiNNoYZqNQMghopJCWqSKKblb5p5ma8ognkYPiOOmce5LqpHMmxummoZ7CSSicaAr/+aieqpZa
J62bunqpmLeyiqalTboK4q+wkvrmrVgOtCSmvPZZJqCvMiqsn6Zumeax1LKK66fZOiutra+26SS2
tmILLYlZ7iqptZyuyKF8317JIpPvBrulu6N2W6WSlkLa3p3xRsljgDc+yye4nfoJaIIaNuxwdB4+
LPGswjE88cUYJ5rxxgwmZzHHIIcs8sjAfUzyySinLHFtLLfs8sswxyzzzDTXbPPNOOes88489+xz
WIT9LBJmdvkUmFlCk+RU0F8NxfRDlnn2NF1cYcWT05tNfVLVcm2W9WVXZxb2YUdpFhrXmUXWmNYm
oY21Y2/H/RTbM719NtxSrS2T22ob/+2V3ny1ZRVkVwnut9hq8a1212zhnRfhkD/+GN17Ey43WZE1
nffmf9e9uOSDRR56X1RptvReRDdtdtWHmw3T4WA77bfdY6dNtlhIg377aJRv3TbQuY/uVuagwU4T
ZyD1XrljcnFmfNLQRy/99NRXb/312GevfUjKA8aAQd8zID5B4xckfvkPnI++QOvftPrzwB9EWND0
w+46St+bz775+Q/Uf/r78x/5/meT0wWOaqZDHuK2Mj+oGHAl/+tfBAMIwINMMIAEPJ4DSac5+snP
LA0UnWFOcsEKYlCAFiQfCjNolMaMsHQvDKEIM+fC7m2khBJUoQnPxz71oZCCZaMhAv8r88HPMU94
LzRJ/nCoQwIuEYgldN8Dk1g6BY5wafU5Yg1d8sQfqq98TqSgBL8YRC3WxYVXJGLwtsjFMJpwhU1U
YQZZ+Loi7g6GhZGhGQ/Ix5asj4dz9B8PgZi+QBaQaPdTnf0S+LwHvs+K27tbJK9nw0la8pKYzCRr
KgkYAXhSAAP5JEE8OUqDiFIgnwRlFZGXSLB4MHgcjN1O4IcSVaIylAUhJS5NuctbJsWAUwQaI3EC
yWJukHi1TIgtH6BKWy6zl8+cCjBjCcNXHhFza4wLJzESzV4y05ff5CU4E6fNtQjumqgj2zSReZJu
gnOZzTwIPE+puXKa05p9sVs+7bn/EneG85/h7KY7/VkTVlLTKlbUY33QprttXsSfzkxlPMVJUdzt
0ZzphCU713lHksBzl9EEpUC9SdDlXZScebTjHjlKxZKkMpSkDCkzJTrTiOryl4ik5SpZyciE5m2R
kNSkYhwqVJYRtahITapSl1pGpt4FqEd9CT7ZGUOouoQxcLGM0RYqNgUGlSUsjSpYhznL+SmUnyqJ
GgfROEUsalCEYk1rDFWKzZUeVGka7SND9drRlrCRnFPN6Fn7KFd08nWfn4vrRvSp2JQEdbBphKtf
GTgXR2rRdHdNa1uL5tM1ZhGxwUSJWh2X0YZmVrTZPGNpqTnY0PrOsEjcK+1Sd1WV/zbWsaulaljR
ilvY2o54mx2tX3P61Z1isXX3c6RVh1uUz16mrIhlSl6Tdlunnqa61s2udrfL3YZgl7uP/O7viMlT
rz52uWDNp1tpuNlfHrOvYqnsezuXkN2ml72zVG90mxpbqqVUsi217305ajgAi1cjAk7LOZEGzEQm
eCVe7RrtUHdgBM+3wtxjGmN5y0fXira9Zfnrb6UpX6oqkpjkXUpoH6xZ0E4OrcUto4frqc8irvjC
tf0bZrD2Fsy2tIBCVC0S7WjZDp+We3MDYX61euTXmTfGOEUuWb/Wt/JiWI11fbF0mWxi7F25u0MF
s5jHTOYyQ83MFGGdlf0SWPSmuP+sX4YlW7NIW57md6wgbnILp3yYGwMYwqQ96XqfK90c23PG0pzr
RteK4/vOMMiM43GWAa1GRLsXn4hk9J8L+2gYi64tC+Y08yyNUyzrFX4sfm2nA+fjx1lNqgzcb+I6
e2hNm9bRunNxkAUTZzmn1r//rTUyUz3eVRe5qyomdK9PCmmMBtvIiW20o2vc7FBbm7kqJu6yFxte
2a25ysfdNnSz5jzS+VS41BM3ml257na7+93dVbf2wksZrH6bsuGWqvHed2dCx+/WidmxtHetZ48c
W8f9HrGzSQ082XKY2Heha+henWsFc7hozxaxsOGbPIlTvMA/3vOGh+pwwm485Bn/LjfePl5wIJsc
MFD1Nq372zjDhDjELS/oxdmsTo8PPMdR43XsoKzzTSMGjZG9NcM7bkT6Jtm3Is83yYFK3lG7GcL7
tp+SoS5UecObv18Pu9jHrjOvY5LeGJd4z+V3dccmN9xIlzm+yV042nIE4sb1WqxRnNqlfySYBtXy
wFnKdYPvvJqmnnSooc3xv4+acUpncOJzfhGNs3uqbGwt5S3MuZETfsgmxnDrNr83TBtR810eieLy
0mrQI33ofud87KU4Wq5yVdeNN3yj2Qp5Y9e3t7N3+V5jifrcd8RtAt940Cef+qMZ3eLPJv7uSY+R
z59z0J5eNcor33ZXdjuvyr03/9ZHfxaGJrSRUtZ62cn+GrOz//3wj3895V+Z7v/7ssmtv/h7+9O1
JtuB2GdSNHdPUnZXxvR8xdY30idYASh81AdrpkdExbd9uhdpiyZYE+deL9dBppY6r4d3qtd5F/hf
oEaBHzZy98R8oDOB4mZfMsQ3FCdjD+hk6GY5dfZzwEdwuaM4/yeDzaeBw2druGeCx9c8JfZ4x9SD
noOA7JZxQph5M8h9w5Z0TleDNCh1BGhlcvdraHdV1FZ3W1VeQkhJ9Jca7leGaJiGariGbNiGbviG
cCg9jXVgX5YADWGHOdNKbzV3LJEAePgAfniHG/GHgDgQfhiIBIGI+DaHonaGzP8XfBqhiIqoEIR4
EYSIh5eYiJXYbM6napRFZWAzOYZTTM7TdhpWiio3Oo90EHbYioUoEIeoiZI4iYYIi7FoEJn4irgI
i3RlNSDXVXpHhJWHZYATN5eTRMU4hURmgZJzjHrhiq5YEJhYi7q4idPIi9KYiIZojdh4TYJBX8f4
g3end8k3GEcIenDGjDZHjkeYjOB4P9f4h4d4ja84j9xYjbtIjduojbpobvxUjEEYgvOljjq4jOCo
jI/mjCt4R/HYjfRIj6zokPnYjfxoj5u4egepTdSGV5+mjlBYWu5IhSHpjgqZjRVJjfIokSaZkiaJ
jbmYi9FVZDUmb6sIeeRnhGz/14NbyIehaJOz45OEUYnyeIuASJREeZIUuY2TOI/62I9DZ27p15PG
F4fuQ5WSoVNWmZVauZVc2ZVe+ZVgGZZiOZY900UIQUcxg5YpZBNqqRBt6RE+REhnuRBu9EVLFJeF
hJcJ8UcD1D596Zcq8ZYQQUYvkUMjcUGC2ZZ1uZYnNJhM9EP6A5kQxBFRNJly2RF0ZJZ4aZiRCUfg
E0eDuUNyyUKIWUg99EeDlJc5ND5PlJpxOUboEz6A+UawGUGvCZqyeZq26ZqHOZcVVJpvpEOe2Zm/
GRHhM5ySCUU9BJlmyZzLiUGcCZzQmZy0qZzVeZ136ZzXGZxw6ZvNKUBoaZd3+3mbYkSYbtmYhkSc
zSmd1MmenFmcyEmaXgSajYmewgmfYtSba/mdz+mbyClIfBma+8OfpLmZfxmbscmY+Cma8Wmd/IOa
5Fmf8Lmbg/SYIZGZEgqeexmZ8pmfAgpABKqg2rmh3ImdwumeDnqi7UmfE3qfI1oSwLmeGSqZ/Gmi
Isqc74mhn/miEiqj24mi23mfPjpG5dmj9JmgJGGgO8Sbl1mXhBlGdkmdtEmhJEqcqgmgVGqd5vmc
tcmjhDSeu7mkx7mgVwqgDCobgvkVacoSa2oU4vmmcBqncjqndFqndnqneJqnerqnfNqnc/p+bRqY


--------------011109050304050804020004--

Problem with rules to catch inline images

Reply via email to