Re: pdf spams

Darxus-5+gNnNaL/BD/[email protected] wrote:
> I have been hearing that spammers are generally switching away from image
> spams toward pdf spams.  When the time comes that I start seeing them
> myself I will start blocking all emails with pdf attachments, just as I
> currently block all emails with inline attached images (potential image
> spams).
> 
> But for now, pdf spams are not getting through:
> 
> * greylisting (postgrey)
> * reject_unknown_client
> * zen.spamhaus.org blacklisting
> * clamav
> * spamprobe
> * spamassassin

I'm using a subset of these with good success:

 * greylisting (postgrey) - can't say enough good things about GL
 * clamav
 * spamprobe (normal and "whitelist mode")

PDF spams seem incredibly stupid to me.  Inline image spams make sense
since the user will see them.  At least in thunderbird you have to
deliberately open a pdf to see it.  Do people really open these things??

I added the extra test for pdf attachments to my procmailrc file
because I was getting a few pdfs a week.  Since then only one made it
to the special test though.  SP definitely learns to catch them after
an initial training period.


> I had been running greylisting for some time.  For some reason I turned it
> off, and was really surprised that the amount of spam I was getting didn't
> increase.  But then it gradually increased.  A lot.  Then I turned
> greylisting back on again, and it all went away, again.  So spammers do
> learn who is greylisting and stop pounding on you.  Also, greylisting is
> good stuff.

Yeah, greylisting won't stop a spammer with a fully compliant mail
server but it works nonetheless.  The number of spam emails processed
by spamprobe dropped by over 90% here when I added postgrey to my
stack.  That's pretty astounding.  It's pretty annoying when you
register on a new web site though.  Some mail servers can take a LONG
time to retry after getting the "unavailable" code.


All the best,
++Brian

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/