Here's a new style of PDF spam (recipient email address is munged):
http://Puffin.net/software/spam/samples/0004_pdf_gen3.eml
This time, it (apparently) is plain text with a link to an ED site, with
rather explicit language. I've only found two of these so far.
From a technical point of
At 12:49 05-07-2007, Chip M. wrote:
Here's a new style of PDF spam (recipient email address is munged):
[snip]
- uses application/octet-stream instead of application/pdf
as the Content-Type
From your sample:
Content-Type: application/octet-stream; name=Message.pdf
You could match on
At 01:09 PM 7/5/2007 -0700, you wrote:
You could match on the application/octet-steam and the file
extension being .pdf.
Good idea, but sorry, I should have been clearer (my BIM):
I meant use that in COMBINATION with OTHER signs, mainly to detect the
difference between the two styles.
To clear
I receive quite a few legitimate pdf attachments - half of them are pdf type,
the
other half is octet-string
(but they are usually A4 paper size)
Wolfgang Hamann
Here's a new style of PDF spam (recipient email address is munged):
[snip]
- uses application/octet-stream instead of
