Can someone point me to a sa developer? We've been doing some hacking on SA at work (guardiandigital.com) and have a rule that we'd like to get run against the corpus. It's not worth getting all set up as real submitters, so maybe someone could just toss it in with their next run..? The suspicion is that this might help against the current flood of image spam. Eric noticed that most of it seems to be sent as multipart related instead of the common way, but we're a little concerned about false positives.

Thanks!

Mike-

header LOCAL_MULTIPART_RELATED Content-Type =~ /multipart\/related;/
score LOCAL_MULTIPART_RELATED 0.753
describe LOCAL_MULTIPART_RELATED Stock messages with images attachments

Reply via email to