At 12:49 05-07-2007, Chip M. wrote:
Here's a new style of PDF spam (recipient email address is munged):
[snip]
- uses "application/octet-stream" instead of "application/pdf" as the Content-Type
From your sample: Content-Type: application/octet-stream; name="Message.pdf"You could match on the "application/octet-steam" and the file extension being ".pdf".
Regards,-sm
