Re: sample of new style PDF spam (containing embedded link, no image)

[ha...@t-online.de]

I receive quite a few legitimate pdf attachments - half of them are pdf type, the
other half is octet-string
(but they are usually A4 paper size)

Wolfgang Hamann


>> >Here's a new style of PDF spam (recipient email address is munged):
>> 
>> [snip]
>> 
>> >  - uses "application/octet-stream" instead of "application/pdf"
>> >    as the Content-Type
>> 
>>  From your sample:
>> 
>>   Content-Type: application/octet-stream; name="Message.pdf"
>> 
>> You could match on the "application/octet-steam" and the file 
>> extension being ".pdf".
>> 
>> Regards,
>> -sm 
>> 
>>