# contains single jpeg 230-400 (high) x 230-400 (wide)
# inline attachment, but not html
# from fishy IP
body          __DC_JPEG_230_400         eval:image_size_range('jpeg', 230, 230, 400, 400)
mimeheader    __INLINE_ATT              Content-Disposition =~ /inline/
#header        __HEADER_CNT_CTYPE_3      eval:check_header_count_range('Content-Type','3','3')

meta        SUSP_JPG    ((RDNS_DYNAMIC || RDNS_NONE || RCVD_IN_PBL) && __JPEG_ATTACH_1 && __DC_JPEG_230_400 && __INLINE_ATT && !HTML_MESSAGE)
describe    SUSP_JPG    Contains supect sized single jpeg and comes from fishy ip
score       SUSP_JPG    2.5