ftp://ftp.fcimail.org/IT/SA_Sample/message.txt
-----Original Message----- From: John Hardin [mailto:[email protected]] Sent: Tuesday, June 02, 2009 11:18 AM To: SpamAssassin Users List Subject: Re: word doc spam On Tue, 2 Jun 2009, Dave Walker wrote: > John Hardin wrote: >> On Tue, 2 Jun 2009, Jean-Paul Natola wrote: >> >>> Is there a rule to catch these messages with no body and a 550 bite >>> word attachment? >> >> Can you post a sample somewhere for us? > > Hi, > > I assume he means the recent surge in "rtf" attachment spam. I've posted > two examples: > http://spam.daviey.com/rtfspam.txt > http://spam.daviey.com/rtfspam1.txt The recent no-text-parts rules should catch that. To recap: header __CTYPE_MULTIPART_ANY Content-Type =~ /multipart\/\w/i ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __ANY_TEXT_ATTACH Content-Type =~ /text\/\w+/i meta MIME_NO_TEXT (__CTYPE_MULTIPART_ANY && !__ANY_TEXT_ATTACH) score MIME_NO_TEXT 2.00 describe MIME_NO_TEXT No text body parts endif -- John Hardin KA7OHZ http://www.impsec.org/~jhardin/ [email protected] FALaholic #11174 pgpk -a [email protected] key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 ----------------------------------------------------------------------- It is not the place of government to make right every tragedy and woe that befalls every resident of the nation. ----------------------------------------------------------------------- 4 days until the 65th anniversary of D-Day
