I'm just waiting for some votes before I release the SARE ruleset for these guys. I finally believe I got it nailed down.
Thanks,
Chris Santerre
SysAdmin and Spamfighter
www.rulesemporium.com
www.uribl.com
> -----Original Message-----
> From: Derek Harding [mailto:[EMAIL PROTECTED]]
> Sent: Friday, October 13, 2006 5:26 PM
> To: users@spamassassin.apache.org
> Subject: RE: Having issue with a type of spam I havn't seen before
>
>
> On Fri, 2006-10-13 at 15:22 -0600, Chris Stone wrote:
> > On Fri, 2006-10-13 at 10:38 -0400, Dylan Bouterse wrote:
> > > I’m trying to write a rule to score src="" but I can’t
> seem to get
> > > it right. Can somebody shed some light on what I’d use for the
> > > 20_phrases.cf file so I can start scoring this? Thanks.
> >
> > Here's what I am using with success:
> >
> > rawbody SENET_INLINEIMG /src\s*=\s*["']cid:/i
>
> Sometime ago I wrote this rule:
> rawbody INLINE_IMAGE /src\s*=\s*["']cid:/i
> describe INLINE_IMAGE Inline Images
> score INLINE_IMAGE 1.5
>
> Works fine though it will catch users who use an attached image for
> their sig or use email templates with background images.
>
> I think these days most people are going the ocr route.
>
> Derek
>
>
>
