On 6 Jan 2007, at 22:38, Roger Millin wrote: > Niall said: > Most of the spam I get these days comes from >> compromised computers and is in the form of an image so that it > can't be >> filtered on the headers or the content. > > Yep, most frustrating, I can't find a way of stopping the 4 - 5 per > day that get through all my other layers of protection and they're all > done with embedded images within random wording, constantly changing > addresses etc, etc.
There is a way of filtering them out - it works fine for me. Image spam almost always has the Content-Type header set to 'multipart/related'. Normal email with attachments almost always has Content-Type set to 'multipart/mixed'. It seems to be a trait of this kind of spam that they use 'multipart/related'. Don't ask me why - anyone care to speculate? Anyway, if you can create your own filtering rules, check for 'multipart/related' and dump any in your junk/spam mailbox. I have this as the lowest priority rule so that any genuine 'multipart/ related' mail on various mailing lists or from people in my address book gets dealt with properly and doesn't fall into the trap. I have yet to see a genuine mail from anyone that uses multipart/ related for attachments. -- Andy Greener n.b. Whisper Pangbourne, UK http://www.nb-whisper.com "The human brain starts working the moment you are born, and never stops until you stand up to speak in public."
