Darrin Chandler wrote:
> On Tue, Nov 21, 2006 at 10:15:18PM -0700, Kurt Granroth wrote:
>
>> How are y'all dealing with the massive increase in .gif spam? Those are
>> the emails that have some random innocuous text and then an attached gif
>> file that contains the actual spam message (usually stock pump-n-dumps).
>> My spamassassin and bogofilter setup is just not catching those at all.
>>
>> What I'd like to do is create some sort of filter that will capture
>> *all* messages that have a single .gif attachment and put them into a
>> "probably spam" folder. Unfortunately, I cannot yet figure out how to
>> do this.
>>
>> It looks like SA might not inspect attachments at all so I moved on to
>> procmail. Procmail, too, seems to have little to no knowledge of
>> attachments. Maybe Amavis? Seems weird to use an anti-virus app for
>> spam, though.
>>
>> So what are y'all doing to combat these?
>>
>
> I've seen a couple of those come through lately, but not too many. Are
> you greylisting?
>
>
I get gazillions of them every day but I rarely ever see one. I've had
really good luck with bayes catching literally any amount of garbage
text they throw at me. Are you sa-learn'ing your spam and ham? I have a
cron job setup to do this every sunday night.
-Mike
---------------------------------------------------
PLUG-discuss mailing list -
PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change you mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
.%0A>%20>>%20%20My%20spamassassin%20and%20bogofilter%20setup%20is%20just%20not%20catching%20those%20at%20all.%0A>%20>>%0A>%20>>%20What%20I'd%20like%20to%20do%20is%20create%20some%20sort%20of%20filter%20that%20will%20capture%0A>%20>>%20*all*%20messages%20that%20have%20a%20single%20.gif%20attachment%20and%20put%20them%20into%20a%0A>%20>>%20%22probably%20spam%22%20folder.%20%20Unfortunately,%20I%20cannot%20yet%20figure%20out%20how%20to%0A>%20>>%20do%20this.%0A>%20>>%0A>%20>>%20It%20looks%20like%20SA%20might%20not%20inspect%20attachments%20at%20all%20so%20I%20moved%20on%20to%0A>%20>>%20procmail.%20%20Procmail,%20too,%20seems%20to%20have%20little%20to%20no%20knowledge%20of%0A>%20>>%20attachments.%20%20Maybe%20Amavis?%20%20Seems%20weird%20to%20use%20an%20anti-virus%20app%20for%0A>%20>>%20spam,%20though.%0A>%20>>%0A>%20>>%20So%20what%20are%20y'all%20doing%20to%20combat%20these?%0A>%20>>%20%20%20%20%20%0A>%20>%0A>%20>%20I've%20seen%20a%20couple%20of%20those%20come%20through%20lately,%20but%20not%20too%20many.%20Are%0A>%20>%20you%20greylisting?%0A>%20>%0A>%20>%20%20%20%0A>%20I%20get%20gazillions%20of%20them%20every%20day%20but%20I%20rarely%20ever%20see%20one.%20I've%20had%20%0A>%20really%20good%20luck%20with%20bayes%20catching%20literally%20any%20amount%20of%20garbage%20%0A>%20text%20they%20throw%20at%20me.%20Are%20you%20sa-learn'ing%20your%20spam%20and%20ham?%20I%20have%20a%20%0A>%20cron%20job%20setup%20to%20do%20this%20every%20sunday%20night.%0A>%20%0A>%20-Mike%0A>%20%0A>%20---------------------------------------------------%0A>%20PLUG-discuss%20mailing%20list%20-%20PLUG-discuss@lists.plug.phoenix.az.us%0A>%20To%20subscribe,%20unsubscribe,%20or%20to%20change%20%20you%20mail%20settings:%0A>%20http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss%0A>%20%0A>%20 "Reply to this message")
(text/plain)