I'm sure anyone with responsibility for spam filtering has seen
messages, many of them, which meet the following criteria:

HTML formatted
empty body
one attachment, which is a pdf file

Is there a spamassassin test which would score such messages very highly?

Or, does anyone have a maildrop recipe for this crap? (or procmail)


Best,

--
No no no, my fish's name is Eric, Eric the fish. He's an halibut. I am
not a looney! Why should I be tarred with the epithet looney merely
because I have a pet halibut?


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Eric d'Alibut <eric.halibut@gmail.com>:
> I'm sure anyone with responsibility for spam filtering has seen
> messages, many of them, which meet the following criteria:
>
> HTML formatted
> empty body
> one attachment, which is a pdf file
>
> Is there a spamassassin test which would score such messages very highly?
>
> Or, does anyone have a maildrop recipe for this crap? (or procmail)

I use this (in procmail) for image attachments:

---------------------------
:0
* B ?? ^Content-Type:.*image/(gif|jpeg|pjpeg)
{
LOG="vsnag2 - "
:0:
00.attachment
}
---------------------------


--
Any technology distinguishable from magic is insufficiently advanced.
(*) http://blinkynet.net/comp/uip5.html Linux Counter #80292
- - http://www.faqs.org/rfcs/rfc1855.html Please, don't Cc: me.


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Eric d'Alibut wrote:
> I'm sure anyone with responsibility for spam filtering has seen
> messages, many of them, which meet the following criteria:
>
> HTML formatted
> empty body
> one attachment, which is a pdf file
>
> Is there a spamassassin test which would score such messages very highly?

If you are not aware of 'sa-update' then that may be enough just like
this:

sudo sa-update

Or to see what is happening:

sudo sa-update -D

This installs updates in /var/lib/spamassassin/*/* under a versioned
subdirectory. Beyond this if that is not enough then the general
advice from the SA list seems to be to install the PDFinfo plugin.

http://www.rulesemporium.com/plugins.htm

For me the sa-update updated rules are sufficient.

Bob


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org