How are y'all dealing with the massive increase in .gif spam? Those are
the emails that have some random innocuous text and then an attached gif
file that contains the actual spam message (usually stock pump-n-dumps).
My spamassassin and bogofilter setup is just not catching those at all.
What I'd like to do is create some sort of filter that will capture
*all* messages that have a single .gif attachment and put them into a
"probably spam" folder. Unfortunately, I cannot yet figure out how to
do this.
It looks like SA might not inspect attachments at all so I moved on to
procmail. Procmail, too, seems to have little to no knowledge of
attachments. Maybe Amavis? Seems weird to use an anti-virus app for
spam, though.
So what are y'all doing to combat these?
Kurt
---------------------------------------------------
PLUG-discuss mailing list -
PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change you mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
.%0A>%20%20My%20spamassassin%20and%20bogofilter%20setup%20is%20just%20not%20catching%20those%20at%20all.%0A>%20%0A>%20What%20I'd%20like%20to%20do%20is%20create%20some%20sort%20of%20filter%20that%20will%20capture%0A>%20*all*%20messages%20that%20have%20a%20single%20.gif%20attachment%20and%20put%20them%20into%20a%0A>%20%22probably%20spam%22%20folder.%20%20Unfortunately,%20I%20cannot%20yet%20figure%20out%20how%20to%0A>%20do%20this.%0A>%20%0A>%20It%20looks%20like%20SA%20might%20not%20inspect%20attachments%20at%20all%20so%20I%20moved%20on%20to%0A>%20procmail.%20%20Procmail,%20too,%20seems%20to%20have%20little%20to%20no%20knowledge%20of%0A>%20attachments.%20%20Maybe%20Amavis?%20%20Seems%20weird%20to%20use%20an%20anti-virus%20app%20for%0A>%20spam,%20though.%0A>%20%0A>%20So%20what%20are%20y'all%20doing%20to%20combat%20these?%0A>%20%0A>%20Kurt%0A>%20---------------------------------------------------%0A>%20PLUG-discuss%20mailing%20list%20-%20PLUG-discuss@lists.plug.phoenix.az.us%0A>%20To%20subscribe,%20unsubscribe,%20or%20to%20change%20%20you%20mail%20settings:%0A>%20http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss%0A>%20%0A>%20 "Reply to this message")
(text/plain)