Hi, I've seen a couple of hundred phishing emails come in that all had an attachment of type "application/html" which is (of course) bogus.
I've put in a rule to block these and will see how it goes. I've put an example up at http://pastebin.com/M3dRp4dD with only slight editing to hide the actual recipient's name. Regards, David.