Re: MP3 Spam

UxBoD writes:
> Does anybody have one of these, or different one, that you could upload somewhere so can do some analysis ?

sure: http://taint.org/x/2007/mp3spam.txt anyway, these rules catch them as far as I can tell:

  ifplugin Mail::SpamAssassin::Plugin::MIMEHeader

  mimeheader __CTYPE_STORM_MP3_1 Content-Type:raw =~ /^audio\/mpeg;\n name=\"[a-z]+\.mp3\"$/s
  mimeheader __CDISP_STORM_MP3_1 Content-Disposition:raw =~ /^inline;\n filename=\"[a-z]+\.mp3\"$/s
  mimeheader __CTYPE_STORM_MP3_2 Content-Type:raw =~ /^audio\/mpeg;\n\tname=\"[a-z]+\.mp3\"$/s
  mimeheader __CDISP_STORM_MP3_2 Content-Disposition:raw =~ /^attachment;\n\tfilename=\"[a-z]+\.mp3\"$/s

  meta JM_STORM_MP3      ((__CTYPE_STORM_MP3_1&&__CDISP_STORM_MP3_1) || (__CTYPE_STORM_MP3_2&&__CDISP_STORM_MP3_2))

--j. Received on Thu Oct 18 15:30:22 2007