On Tue, Nov 21, 2006 at 10:15:18PM -0700, Kurt Granroth wrote:
> How are y'all dealing with the massive increase in .gif spam? Those are
> the emails that have some random innocuous text and then an attached gif
> file that contains the actual spam message (usually stock pump-n-dumps).
> My spamassassin and bogofilter setup is just not catching those at all.
>
> What I'd like to do is create some sort of filter that will capture
> *all* messages that have a single .gif attachment and put them into a
> "probably spam" folder. Unfortunately, I cannot yet figure out how to
> do this.
>
> It looks like SA might not inspect attachments at all so I moved on to
> procmail. Procmail, too, seems to have little to no knowledge of
> attachments. Maybe Amavis? Seems weird to use an anti-virus app for
> spam, though.
>
> So what are y'all doing to combat these?
I've seen a couple of those come through lately, but not too many. Are
you greylisting?
--
Darrin Chandler | Phoenix BSD Users Group
dwchandler@stilyagin.com | http://bsd.phoenix.az.us/
http://www.stilyagin.com/ |
---------------------------------------------------
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change you mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
.%0A>%20>%20%20My%20spamassassin%20and%20bogofilter%20setup%20is%20just%20not%20catching%20those%20at%20all.%0A>%20>%20%0A>%20>%20What%20I'd%20like%20to%20do%20is%20create%20some%20sort%20of%20filter%20that%20will%20capture%0A>%20>%20*all*%20messages%20that%20have%20a%20single%20.gif%20attachment%20and%20put%20them%20into%20a%0A>%20>%20%22probably%20spam%22%20folder.%20%20Unfortunately,%20I%20cannot%20yet%20figure%20out%20how%20to%0A>%20>%20do%20this.%0A>%20>%20%0A>%20>%20It%20looks%20like%20SA%20might%20not%20inspect%20attachments%20at%20all%20so%20I%20moved%20on%20to%0A>%20>%20procmail.%20%20Procmail,%20too,%20seems%20to%20have%20little%20to%20no%20knowledge%20of%0A>%20>%20attachments.%20%20Maybe%20Amavis?%20%20Seems%20weird%20to%20use%20an%20anti-virus%20app%20for%0A>%20>%20spam,%20though.%0A>%20>%20%0A>%20>%20So%20what%20are%20y'all%20doing%20to%20combat%20these?%0A>%20%0A>%20I've%20seen%20a%20couple%20of%20those%20come%20through%20lately,%20but%20not%20too%20many.%20Are%0A>%20you%20greylisting?%0A>%20%0A>%20%0A>%20 "Reply to this message")
(text/plain)