On Wed, Aug 02, 2006 at 11:17:35AM +0100, Randal, Phil wrote: > rawbody INLINE_IMAGE2 /src\s*=\s*["']cid:image001\.gif/i > describe INLINE_IMAGE2 Inline Image image001.gif > score INLINE_IMAGE2 5.0
fwiw, that hits on any outlook message which references an included gif. > Will work wonders till they change the filename. It looks like they've generated the message using Outlook and then sent it out -- with one non-Outlook issue in the header. FWIW, I put in a rule via sa-update yesterday to address these mails, which as you say will work until they change the filename. > We could do with a Spamassassin plugin to match inline/attached file > names, to make it easy to score attached/embedded images by name. MIMEHeader ? Been there for ages. :) -- Randomly Generated Tagline: Stop searching. Happiness is right next to you. Now, if they'd only take a bath ...
pgpKDx2NkmptI.pgp
Description: PGP signature
