You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Kevin Peuhkurinen <ke...@hepcoe.com> on 2005/02/01 14:20:44 UTC
Problem with rules to catch inline images
Hey folks. I'm seeing a fair bit of spam getting through with embedded
GIF images, a slightly redacted version being pasted into the bottom of
this email. I'm trying to write a rule to catch embedded GIFs, but it
just doesn't seem to work. I've tried the following:
full KP_GIF2 /name=".{1,8}\.GIF"/i
score KP_GIF2 0.1
and
full KP_GIF3 /Content-Type\: image\/gif\;/i
score KP_GIF3 0.1
Neither of these are firing. Any ideas?
Thanks,
Kevin
From - Tue Feb 1 07:26:30 2005
X-Account-Key: account1
X-UIDL: AAAK7NqAAAgtpma5Rl/L1ikghkc3s3NF
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Received: from jedi.hepcoe.com ([XXXXXXXXXXX]) by exch-prod.hepcoe.com
with Microsoft SMTPSVC(6.0.3790.0);
Tue, 1 Feb 2005 05:06:35 -0500
Received: from localhost ([127.0.0.1])
by jedi.hepcoe.com with esmtp (Exim 4.42)
id 1Cvuvb-0006ya-BD
for kevin.peuhkurinen@hepcoe.com; Tue, 01 Feb 2005 05:06:35 -0500
Received: from jedi.hepcoe.com ([127.0.0.1])
by localhost (jedi [127.0.0.1]) (amavisd-new, port 10024) with ESMTP
id 26687-07 for <ke...@hepcoe.com>;
Tue, 1 Feb 2005 05:06:34 -0500 (EST)
Received: from newfirewall.hepcoe.com ([XXXXXXXXXXX]
helo=fw-prod.hepcoe.com)
by jedi.hepcoe.com with smtp (Exim 4.42)
id 1CvuvB-0006x1-3P
for kevin.peuhkurinen@hepcoe.com; Tue, 01 Feb 2005 05:06:09 -0500
Received: from smtp01.tidc.telus.com ([66.203.199.217]) by
fw-prod.hepcoe.com; Tue, 01 Feb 2005 05:06:03 -0500 (Eastern Standard Time)
Received: (qmail 21437 invoked from network); 1 Feb 2005 10:06:01 -0000
Received: from unknown (HELO 207.219.111.25) (61.174.186.211)
by 0 with SMTP; 1 Feb 2005 10:06:01 -0000
Received: from mdnwjn.probe.net (HELO oengs64) ([159.133.187.140])
(envelope-sender <ns...@probe.net>)
by ebwze.probe.net (Postfix) with smtp
for <ke...@hepcoe.com>; Tue, 01 Feb 2005 04:02:19 -0600
Message-ID: <16...@pantygirl.com>
From: "Estelle Hightower" <xx...@caboodles.com>
To: "Kennedy" <ke...@hepcoe.com>
Subject: Re: Clinoril 500/80mg repertory
Date: Tue, 01 Feb 2005 04:02:19 -0600
MIME-Version: 1.0
To: kennedy@hepcoe.com
Subject: mild Lortab may make you drowsy
Content-Type: multipart/related;
boundary="------------011109050304050804020004"
X-Spam-Status: No, hits=3.278 tagged_above=-5 required=3.5 tests=BAYES_01,
FVGT_m_MULTI_ODD2, FVGT_m_MULTI_ODD3, HTML_MESSAGE, RCVD_IN_NJABL_DUL,
RCVD_IN_SORBS_DUL, RCVD_NUMERIC_HELO
X-Spam-Level: ***
Return-Path: xxhpiis@caboodles.com
X-OriginalArrivalTime: 01 Feb 2005 10:06:35.0957 (UTC)
FILETIME=[B69F0E50:01C50845]
This is a multi-part message in MIME format.
--------------011109050304050804020004
Content-Type: multipart/alternative;
boundary="------------010902060907010108080001"
--------------010902060907010108080001
Content-Type: text/plain;
charset="windows-1251"
Content-Transfer-Encoding: 7bit
him, said with a smile, You should have moved your master not to
exclaimed, O foolish creature that I am! For the sake of a
A SICK STAG lay down in a quiet corner of its pasture ground.
then zoomed off to the airport. I believe he was cutting it rather close.
--------------010902060907010108080001
Content-Type: text/html;
charset="windows-1251"
Content-Transfer-Encoding: 7Bit
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=windows-1251">
</HEAD>
<BODY><p><FONT SIZE=1></FONT><A
href="http://gqstprfwc.annualize6lesser.com/?TM4eihDDf0MJJtQ"><FONT></FONT>
<font></font><IMG SRC="cid:vlsnxke_vsnales_joufbqo" border="0"
ALT=""></A></p><p><FONT size=1>stores were closing up, and I knew Burger
King would remain open for a Think of past tradesmen tradesperson who no
longer have a place<BR>means being pushed and pulled. But I would
rather be respected<BR>
shop getting fixed by Apple, and one was my mom's computer, 3,000 each
other and with computers, and has drastically changed the<BR>
himself, and by a wily stratagem succeeded. How handsome is the
faults. Hence it is that men are quick to see the faults of<BR>
valuable commodity information that will keep them ahead of the
expressions. For instance, if we were to look at a painting on a<BR>
connected to the same stream of thought, there is room for when
occasion called him one day into the city, he left the sheep<BR>
integration, what will be the dominant culture adapted by all?
experienced before. In their desire to retain that freedom from their
reptilian<BR>
THE PIGEONS, terrified by the appearance of a Kite, called upon case of
special needs children those with learning disabilities<BR>
discover if the Cat in her change of shape had also altered her The
computer is a tool created by the scientist and then<BR>
character is qualified. If no combination of the present scores
interests you, water sprinklers running, ka chick, ka chick, ka chik. I
realized I was in a<BR>
Once you've passed all of these obstacles and reached your destination,
you service; for when the gold was there, you had it not, as you did<BR>
are suddenly the saviors of the souls of the aliens. But at least it is
a way Excess of information the latest news coming straight from<BR>
What free trade agreements do for Global companies and there
methods would have kept beyond me. The only disadvantage, was<BR>
Arranging to meet elsewhere should be done with the utmost care.
Parking entertainment, said in the joy of his heart, How glad I am that<BR>
to another. In most cases the cyberart will be presented to the much
iTunes music that burning it to CD and re ripping it and<BR>
symbols would immediately signify fantasy. Artists will have to
wretched little sluggard! what shall I do to you? While I am<BR>
many a trap and snare, observed from a safe distance the trick of puzzle
is simple: Each letter in the encoded document represents an unencoded<BR>
gun at people who were chasing me, but the gun wouldn't work right.
Finally guessing game which will reduce the risks for patients. Virtual<BR>
are a production of very precise and clean final drawings. These the
town really is. If each of your characters in a party of six is at the<BR>
Castle HillStone is the home of Lord Slayer. Slayer is a fanatic about
hunting,<br> Modern man is the victim of the very instruments he values
</FONT></p>
</BODY>
</HTML>
--------------010902060907010108080001--
--------------011109050304050804020004
Content-Type: image/gif;
name="Xvctxl.GIF"
Content-Transfer-Encoding: base64
Content-ID: <vlsnxke_vsnales_joufbqo>
R0lGODlhFQHYAPcAAAAAAIAAAACAAICAAAAAgIAAgACAgICAgMDAwP8AAAD/AP//AAAA//8A/wD/
/////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMwAAZgAAmQAAzAAA/wAzAAAzMwAzZgAzmQAzzAAz/wBm
AABmMwBmZgBmmQBmzABm/wCZAACZMwCZZgCZmQCZzACZ/wDMAADMMwDMZgDMmQDMzADM/wD/AAD/
MwD/ZgD/mQD/zAD//zMAADMAMzMAZjMAmTMAzDMA/zMzADMzMzMzZjMzmTMzzDMz/zNmADNmMzNm
ZjNmmTNmzDNm/zOZADOZMzOZZjOZmTOZzDOZ/zPMADPMMzPMZjPMmTPMzDPM/zP/ADP/MzP/ZjP/
mTP/zDP//2YAAGYAM2YAZmYAmWYAzGYA/2YzAGYzM2YzZmYzmWYzzGYz/2ZmAGZmM2ZmZmZmmWZm
zGZm/2aZAGaZM2aZZmaZmWaZzGaZ/2bMAGbMM2bMZmbMmWbMzGbM/2b/AGb/M2b/Zmb/mWb/zGb/
/5kAAJkAM5kAZpkAmZkAzJkA/5kzAJkzM5kzZpkzmZkzzJkz/5lmAJlmM5lmZplmmZlmzJlm/5mZ
AJmZM5mZZpmZmZmZzJmZ/5nMAJnMM5nMZpnMmZnMzJnM/5n/AJn/M5n/Zpn/mZn/zJn//8wAAMwA
M8wAZswAmcwAzMwA/8wzAMwzM8wzZswzmcwzzMwz/8xmAMxmM8xmZsxmmcxmzMxm/8yZAMyZM8yZ
ZsyZmcyZzMyZ/8zMAMzMM8zMZszMmczMzMzM/8z/AMz/M8z/Zsz/mcz/zMz///8AAP8AM/8AZv8A
mf8AzP8A//8zAP8zM/8zZv8zmf8zzP8z//9mAP9mM/9mZv9mmf9mzP9m//+ZAP+ZM/+ZZv+Zmf+Z
zP+Z///MAP/MM//MZv/Mmf/MzP/M////AP//M///Zv//mf//zP///ywAAAAAFQHYAAAI/wAfCBxI
sKDBgwgTKlzIsKHDhxAjSpxIsaLFixgzatzIsaPHjyBDihxJsqTJkyhTqlzJsqXLlzBjypxJs6bN
ggAAEMwpMKdPnQ9+Ah3486bRo0gn8iQKdOjOpz2hJp1KtarOpkGjGnSatWvVr2CRXo2KdStOrWHT
qo05NmtToWjRFl1Lt27Jt1q5xvUq1a7fvxnxdtXLt/BewIgTO9Rb9izRx5AVS56MkHFPuEHnMl1K
ubPnz6BDix5NurTp06hTq17NurXr17Bjy55N+2i/27hz697Nu7fv38CDCx9OvLjx48iTK1+OvCDz
59CjS59Ovbp16s6va4cOQHj37du/f/8HT338bvPBs9/ujh497pzv3ft2LxT+cfm86ft8T964UOD4
Tbdff+udl5t56vXDXnz42adggAb2BmFwE/Kn23jiEUiceRBWyByGGtJ3YG7Z1TdifgqmiKGDD7I3
4IUjwgfiejIO+GKLIhaI44EOurjjjUDaN+OJFrZoYYY6GlmgkCwmqeOQL/r4U5FT7mglggTxl6OB
CyKZ4pdFRkgjlU6COeOQZJoZYY9pnngmmEQ+eaScdH7JpoQwqqnnnXYm6aWXcKq3YJ5r1ikeh/PF
eSaiNNoYZqNQMghopJCWqSKKblb5p5ma8ognkYPiOOmce5LqpHMmxummoZ7CSSicaAr/+aieqpZa
J62bunqpmLeyiqalTboK4q+wkvrmrVgOtCSmvPZZJqCvMiqsn6Zumeax1LKK66fZOiutra+26SS2
tmILLYlZ7iqptZyuyKF8317JIpPvBrulu6N2W6WSlkLa3p3xRsljgDc+yye4nfoJaIIaNuxwdB4+
LPGswjE88cUYJ5rxxgwmZzHHIIcs8sjAfUzyySinLHFtLLfs8sswxyzzzDTXbPPNOOes88489+xz
WIT9LBJmdvkUmFlCk+RU0F8NxfRDlnn2NF1cYcWT05tNfVLVcm2W9WVXZxb2YUdpFhrXmUXWmNYm
oY21Y2/H/RTbM719NtxSrS2T22ob/+2V3ny1ZRVkVwnut9hq8a1212zhnRfhkD/+GN17Ey43WZE1
nffmf9e9uOSDRR56X1RptvReRDdtdtWHmw3T4WA77bfdY6dNtlhIg377aJRv3TbQuY/uVuagwU4T
ZyD1XrljcnFmfNLQRy/99NRXb/312GevfUjKA8aAQd8zID5B4xckfvkPnI++QOvftPrzwB9EWND0
w+46St+bz775+Q/Uf/r78x/5/meT0wWOaqZDHuK2Mj+oGHAl/+tfBAMIwINMMIAEPJ4DSac5+snP
LA0UnWFOcsEKYlCAFiQfCjNolMaMsHQvDKEIM+fC7m2khBJUoQnPxz71oZCCZaMhAv8r88HPMU94
LzRJ/nCoQwIuEYgldN8Dk1g6BY5wafU5Yg1d8sQfqq98TqSgBL8YRC3WxYVXJGLwtsjFMJpwhU1U
YQZZ+Loi7g6GhZGhGQ/Ix5asj4dz9B8PgZi+QBaQaPdTnf0S+LwHvs+K27tbJK9nw0la8pKYzCRr
KgkYAXhSAAP5JEE8OUqDiFIgnwRlFZGXSLB4MHgcjN1O4IcSVaIylAUhJS5NuctbJsWAUwQaI3EC
yWJukHi1TIgtH6BKWy6zl8+cCjBjCcNXHhFza4wLJzESzV4y05ff5CU4E6fNtQjumqgj2zSReZJu
gnOZzTwIPE+puXKa05p9sVs+7bn/EneG85/h7KY7/VkTVlLTKlbUY33QprttXsSfzkxlPMVJUdzt
0ZzphCU713lHksBzl9EEpUC9SdDlXZScebTjHjlKxZKkMpSkDCkzJTrTiOryl4ik5SpZyciE5m2R
kNSkYhwqVJYRtahITapSl1pGpt4FqEd9CT7ZGUOouoQxcLGM0RYqNgUGlSUsjSpYhznL+SmUnyqJ
GgfROEUsalCEYk1rDFWKzZUeVGka7SND9drRlrCRnFPN6Fn7KFd08nWfn4vrRvSp2JQEdbBphKtf
GTgXR2rRdHdNa1uL5tM1ZhGxwUSJWh2X0YZmVrTZPGNpqTnY0PrOsEjcK+1Sd1WV/zbWsaulaljR
ilvY2o54mx2tX3P61Z1isXX3c6RVh1uUz16mrIhlSl6Tdlunnqa61s2udrfL3YZgl7uP/O7viMlT
rz52uWDNp1tpuNlfHrOvYqnsezuXkN2ml72zVG90mxpbqqVUsi217305ajgAi1cjAk7LOZEGzEQm
eCVe7RrtUHdgBM+3wtxjGmN5y0fXira9Zfnrb6UpX6oqkpjkXUpoH6xZ0E4OrcUto4frqc8irvjC
tf0bZrD2Fsy2tIBCVC0S7WjZDp+We3MDYX61euTXmTfGOEUuWb/Wt/JiWI11fbF0mWxi7F25u0MF
s5jHTOYyQ83MFGGdlf0SWPSmuP+sX4YlW7NIW57md6wgbnILp3yYGwMYwqQ96XqfK90c23PG0pzr
RteK4/vOMMiM43GWAa1GRLsXn4hk9J8L+2gYi64tC+Y08yyNUyzrFX4sfm2nA+fjx1lNqgzcb+I6
e2hNm9bRunNxkAUTZzmn1r//rTUyUz3eVRe5qyomdK9PCmmMBtvIiW20o2vc7FBbm7kqJu6yFxte
2a25ysfdNnSz5jzS+VS41BM3ml257na7+93dVbf2wksZrH6bsuGWqvHed2dCx+/WidmxtHetZ48c
W8f9HrGzSQ082XKY2Heha+henWsFc7hozxaxsOGbPIlTvMA/3vOGh+pwwm485Bn/LjfePl5wIJsc
MFD1Nq372zjDhDjELS/oxdmsTo8PPMdR43XsoKzzTSMGjZG9NcM7bkT6Jtm3Is83yYFK3lG7GcL7
tp+SoS5UecObv18Pu9jHrjOvY5LeGJd4z+V3dccmN9xIlzm+yV042nIE4sb1WqxRnNqlfySYBtXy
wFnKdYPvvJqmnnSooc3xv4+acUpncOJzfhGNs3uqbGwt5S3MuZETfsgmxnDrNr83TBtR810eieLy
0mrQI33ofud87KU4Wq5yVdeNN3yj2Qp5Y9e3t7N3+V5jifrcd8RtAt940Cef+qMZ3eLPJv7uSY+R
z59z0J5eNcor33ZXdjuvyr03/9ZHfxaGJrSRUtZ62cn+GrOz//3wj3895V+Z7v/7ssmtv/h7+9O1
JtuB2GdSNHdPUnZXxvR8xdY30idYASh81AdrpkdExbd9uhdpiyZYE+deL9dBppY6r4d3qtd5F/hf
oEaBHzZy98R8oDOB4mZfMsQ3FCdjD+hk6GY5dfZzwEdwuaM4/yeDzaeBw2druGeCx9c8JfZ4x9SD
noOA7JZxQph5M8h9w5Z0TleDNCh1BGhlcvdraHdV1FZ3W1VeQkhJ9Jca7leGaJiGariGbNiGbviG
cCg9jXVgX5YADWGHOdNKbzV3LJEAePgAfniHG/GHgDgQfhiIBIGI+DaHonaGzP8XfBqhiIqoEIR4
EYSIh5eYiJXYbM6napRFZWAzOYZTTM7TdhpWiio3Oo90EHbYioUoEIeoiZI4iYYIi7FoEJn4irgI
i3RlNSDXVXpHhJWHZYATN5eTRMU4hURmgZJzjHrhiq5YEJhYi7q4idPIi9KYiIZojdh4TYJBX8f4
g3end8k3GEcIenDGjDZHjkeYjOB4P9f4h4d4ja84j9xYjbtIjduojbpobvxUjEEYgvOljjq4jOCo
jI/mjCt4R/HYjfRIj6zokPnYjfxoj5u4egepTdSGV5+mjlBYWu5IhSHpjgqZjRVJjfIokSaZkiaJ
jbmYi9FVZDUmb6sIeeRnhGz/14NbyIehaJOz45OEUYnyeIuASJREeZIUuY2TOI/62I9DZ27p15PG
F4fuQ5WSoVNWmZVauZVc2ZVe+ZVgGZZiOZY900UIQUcxg5YpZBNqqRBt6RE+REhnuRBu9EVLFJeF
hJcJ8UcD1D596Zcq8ZYQQUYvkUMjcUGC2ZZ1uZYnNJhM9EP6A5kQxBFRNJly2RF0ZJZ4aZiRCUfg
E0eDuUNyyUKIWUg99EeDlJc5ND5PlJpxOUboEz6A+UawGUGvCZqyeZq26ZqHOZcVVJpvpEOe2Zm/
GRHhM5ySCUU9BJlmyZzLiUGcCZzQmZy0qZzVeZ136ZzXGZxw6ZvNKUBoaZd3+3mbYkSYbtmYhkSc
zSmd1MmenFmcyEmaXgSajYmewgmfYtSba/mdz+mbyClIfBma+8OfpLmZfxmbscmY+Cma8Wmd/IOa
5Fmf8Lmbg/SYIZGZEgqeexmZ8pmfAgpABKqg2rmh3ImdwumeDnqi7UmfE3qfI1oSwLmeGSqZ/Gmi
Isqc74mhn/miEiqj24mi23mfPjpG5dmj9JmgJGGgO8Sbl1mXhBlGdkmdtEmhJEqcqgmgVGqd5vmc
tcmjhDSeu7mkx7mgVwqgDCobgvkVacoSa2oU4vmmcBqncjqndFqndnqneJqnerqnfNqnc/p+bRqY
--------------011109050304050804020004--
Re: Problem with rules to catch inline images
Posted by Kevin Peuhkurinen <ke...@hepcoe.com>.
Never mind. It looks like SA 2.64 ignores the entirety of inline binary
components such that "full" does not even expose them. As it turns
out, the spammer has made a number of other errors that I have been
able to draft rules for.
Kevin Peuhkurinen wrote:
> Hey folks. I'm seeing a fair bit of spam getting through with
> embedded GIF images, a slightly redacted version being pasted into the
> bottom of this email. I'm trying to write a rule to catch embedded
> GIFs, but it just doesn't seem to work. I've tried the following:
>
> full KP_GIF2 /name=".{1,8}\.GIF"/i
> score KP_GIF2 0.1
>
> and
>
> full KP_GIF3 /Content-Type\: image\/gif\;/i
> score KP_GIF3 0.1
>
> Neither of these are firing. Any ideas?
>
> Thanks,
> Kevin
>