> -----Original Message-----
> From: Anton Krall [mailto:[EMAIL PROTECTED]]
> Sent: Friday, April 28, 2006 12:36 AM
> To: users@spamassassin.apache.org
> Subject: new type of email spam
>
>
> Guys, today I got a flow of new type of spam, this new email
> has some sort
> of gif or image inside that contains like a letter or some letters...
> Hasanybody seens this and know how to block it?
Well I got the ones that were caught over the weekend. All stock spams that were gif images only. All Caught.
Attached are teh ruls that hit. Any rule that starts with "MY" is something I've written for here. And may or may not have been converted to a SARE rule.
HTH,
Chris Santerre
SysAdmin and SARE/URIBL ninja
http://www.uribl.com
http://www.rulesemporium.com
--
No virus found in this outgoing message.
Checked by AVG Free Edition.
Version: 7.0.385 / Virus Database: 268.5.1/327 - Release Date: 4/28/2006
X-Spam-Status: Yes, score=10.9 required=5.0 tests=EXTRA_MPART_TYPE,
FROM_HAS_MIXED_NUMS,HTML_IMAGE_ONLY_08,HTML_MESSAGE,MIME_HTML_MOSTLY,
MPART_ALT_DIFF,MY_ALT,MY_NO_QU,MY_PHRS_LOW,RCVD_IN_NJABL_DUL,
SARE_FWDLOOK,SARE_RECV_IP_218080 autolearn=disabled version=3.0.0
X-Spam-Status: Yes, score=7.3 required=5.0 tests=EXTRA_MPART_TYPE,HTML_90_100,
HTML_IMAGE_ONLY_04,HTML_MESSAGE,MIME_HTML_MOSTLY,MPART_ALT_DIFF,
MY_ALT,MY_NO_QU,MY_TO_SALES,RCVD_IN_NJABL_DUL autolearn=disabled
X-Spam-Status: Yes, score=7.6 required=5.0 tests=EXTRA_MPART_TYPE,HTML_90_100,
HTML_IMAGE_ONLY_08,HTML_MESSAGE,MIME_HTML_MOSTLY,MPART_ALT_DIFF,
MY_ALT,MY_DSL,RCVD_IN_NJABL_DUL autolearn=disabled
X-Spam-Status: Yes, score=8.6 required=5.0 tests=EXTRA_MPART_TYPE,
HELO_DYNAMIC_IPADDR,HTML_90_100,HTML_IMAGE_ONLY_04,HTML_MESSAGE,
MIME_HTML_MOSTLY,MPART_ALT_DIFF,MY_ALT autolearn=disabled
