Inline image spams

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

I've been experimenting with catching these using a simple procmail rule.
Basically I put any email containing a cid: URL in a src attribute into a
special folder unless the message is from a known source.  That seems to
work extremely well.  Unfortunately it requires manual editing of the
procmailrc to add additional domains to the white list.

I was thinking today that another option would be to first detect if a
message contains an inline image and then, if it does, score the email based
on headers only.  Maybe even ignoring subject since that is generally
meaningless with these.  The beauty of that approach is that any email from
a regular correspondent containing an inline image will sail through because
you'll have their normal headers in your database already.  Any email
containing an inline image with a known spammy header will be recognized no
matter what text they added to the email.  Any email with neutral headers
(random email addresses, etc) will have a neutral score which I can bias
towards spamminess in this mode.

This could all be done within the procmailrc without any changes to
spamprobe, but if it works well I could add support for it to SP.

What do you folks think?

All the best,
++Brian



-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.5.2 (Build 4075)
Charset: US-ASCII

wsBVAwUBRYh8bzxRyEoJfXIFAQg22gf/aM/AUOE+sBkXWJhVLXXB0Xmk8TSRcIp9
2rRZB1okUmhUxLwjxkoKfO6wVbjq8CtHgludR6Fl+fqkJxM6spPmiVRV/uHZOCUp
5ICJtOnKp9Gmpe2FvYL9e0CiJP8DkNAuoUJ8wPE3HPbTQti7NXTpYEI5qvgXaiPI
xz28uIufcOhbkaUgFUF6UEXhsWWCLLIWxyN02zXsWJYwVicZljEiCkV5QtYvYxHe
NvzuTb4lyB9fbXT8dFL0dHOB4qLkWl9rnEHCANM9Z6PVR4sxSPAuhvbRZP1fX0SW
RiuM84prpLv6vXbJ13oYXfKuXiJq0gaaNpVKJdMRYW+rhEvVqzHDUA==
=QQWD
-----END PGP SIGNATURE-----

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV