I'm using your rule here with a low score and in addition: rawbody INLINE_IMAGE2 /src\s*=\s*["']cid:image001\.gif/i describe INLINE_IMAGE2 Inline Image image001.gif score INLINE_IMAGE2 5.0
I know, I should have used a meta rule intead of duplicating the pattern. Will work wonders till they change the filename. We could do with a Spamassassin plugin to match inline/attached file names, to make it easy to score attached/embedded images by name. Cheers, Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -----Original Message----- > From: Derek Harding [mailto:[EMAIL PROTECTED] > Sent: 01 August 2006 01:34 > To: Tim > Cc: users@spamassassin.apache.org > Subject: Re: Image spams getting thru > > On Mon, 2006-07-31 at 19:03 -0500, Tim wrote: > > Thanks for the tip. That sounds pretty effective, > actually. Care to > > share your rule? > > Sure thing: > > rawbody INLINE_IMAGE /src\s*=\s*["']cid:/i > describe INLINE_IMAGE Inline Images > score INLINE_IMAGE 1.5 > > I haven't tested this against the SA corpus so YMMV. > > Derek >
