Rob Mangiafico wrote:
Anyone else find this to be a good rule to catch these image stock spams
without too much collateral damage?
After writing this I did some checks on the SA public corpus. The rule
didn't hit on any of the hard ham. It didn't hit much of the spam either
since very little of that is image spam.
Regarding SARE it has SARE_GIF_ATTACH which matches on any email that
has an attached image. My rule only matches on email that has an
attached image that is referenced in the HTML.
I'm finding it to be very successful and am interested in what others find.
Derek
