Re: Inline image spams

Not everyone uses procmail. I use exim, and various other checks as well 
as spamprobe including a whitelist, a blacklist, rbl lookups to feed 
known spam to spamprobe. I tend to think whitelists should be outside of 
spamprobe.
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
> 
> I've been experimenting with catching these using a simple procmail rule.
> Basically I put any email containing a cid: URL in a src attribute into a
> special folder unless the message is from a known source.  That seems to
> work extremely well.  Unfortunately it requires manual editing of the
> procmailrc to add additional domains to the white list.
> 
> I was thinking today that another option would be to first detect if a
> message contains an inline image and then, if it does, score the email based
> on headers only.  Maybe even ignoring subject since that is generally
> meaningless with these.  The beauty of that approach is that any email from
> a regular correspondent containing an inline image will sail through because
> you'll have their normal headers in your database already.  Any email
> containing an inline image with a known spammy header will be recognized no
> matter what text they added to the email.  Any email with neutral headers
> (random email addresses, etc) will have a neutral score which I can bias
> towards spamminess in this mode.
> 
> This could all be done within the procmailrc without any changes to
> spamprobe, but if it works well I could add support for it to SP.
> 
> What do you folks think?
> 
> All the best,
> ++Brian
>

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV

_______________________________________________
Spamprobe-users mailing list
Spamprobe-users-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
https://lists.sourceforge.net/lists/listinfo/spamprobe-users

begin:vcard
fn:Charles  Abell
n:Abell;Charles 
org:Roditi International
adr:130 Regent St;;Carrington House;London;;W1B 5SE;England
email;internet:charles-SIt0Kka/vc/[email protected]
tel;work:+44 20 7439 4390
tel;fax:+44 20 7434 0896
url:http://www.roditi.com
version:2.1
end:vcard