Filters for .gif spam?

[Darrin Chandler]

On Tue, Nov 21, 2006 at 10:15:18PM -0700, Kurt Granroth wrote:
> How are y'all dealing with the massive increase in .gif spam?  Those are
> the emails that have some random innocuous text and then an attached gif
> file that contains the actual spam message (usually stock pump-n-dumps).
>  My spamassassin and bogofilter setup is just not catching those at all.
> 
> What I'd like to do is create some sort of filter that will capture
> *all* messages that have a single .gif attachment and put them into a
> "probably spam" folder.  Unfortunately, I cannot yet figure out how to
> do this.
> 
> It looks like SA might not inspect attachments at all so I moved on to
> procmail.  Procmail, too, seems to have little to no knowledge of
> attachments.  Maybe Amavis?  Seems weird to use an anti-virus app for
> spam, though.
> 
> So what are y'all doing to combat these?

I've seen a couple of those come through lately, but not too many. Are
you greylisting?

-- 
Darrin Chandler            |  Phoenix BSD Users Group
dwchandler at stilyagin.com   |  http://bsd.phoenix.az.us/
http://www.stilyagin.com/  |