Spam Filter ISP Forums : Spam with PNG attachments https://www.logsat.com/spamfilter/forums/ Sun, 10 May 2026 23:05:26 +0000 Thu, 04 Jun 2009 02:21:41 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 11.04 360 https://www.logsat.com/spamfilter/forums/RSS_post_feed.asp?TID=6670 <![CDATA[Spam Filter ISP Forums]]> https://www.logsat.com/spamfilter/forums/forum_images/web_wiz_forums.png https://www.logsat.com/spamfilter/forums/ <![CDATA[Spam with PNG attachments : We modified this last build of...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6670&PID=12945&title=spam-with-png-attachments#12945 Author: LogSat
Subject: 6670
Posted: 04 June 2009 at 2:21am

We modified this last build of SpamFilter to support a couple of features.
The first one is that you can't use RegEx (at least we haven't figured out a way to do it ourselves...) to specify a keyword that will look for the presence of two different words. For example, we can use RegEx to look for either DOG or CAT, or we can use RegEX to look for the word DOG followed by the word CAT, or to look for the word CAT followed by the word DOG. But for the life of us we could not find a RegEx expression that looked for the presence of both words, in any order, in the text (other than looking for "DOG followed by CAT or CAT followed by DOG" - something like (DOG.*CAT)|(CAT.*DOG). This later expression would be rather complex when looking for the presence of 4 item as we'd have to spell out every single possibility.

So we added an option to be able to specify multiple RegEx expressions on a single line separated by commas. This allows us to look for the presence of *all* the RegEx expressions, thus allowing us to use an AND with RegEx. The only trick here is that, in order to be compatible with all current keyword expressions, when using this format we must specify a "norma" non-RegEx keyword to appear first in the list. All this regression to explain why we need the "Content" keyword to appear first in the list.

The new ::NEGATE option applies only to the specific keyword entry it follows, so here it only applies to the (text/plain)|(text/html)) - neither of these must be present for the entry to match.]]> Thu, 04 Jun 2009 02:21:41 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6670&PID=12945&title=spam-with-png-attachments#12945 <![CDATA[Spam with PNG attachments : LogSat wrote: Content,(content-transfer-encoding:...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6670&PID=12943&title=spam-with-png-attachments#12943 Author: yapadu
Subject: 6670
Posted: 04 June 2009 at 1:42am

Originally posted by LogSat LogSat wrote:


Content,(content-transfer-encoding: base64),(content-disposition: inline),((content-type: image/png)|(content-type: image/jpg)),((text/plain)|(text/html))::NEGATE


Wow, big one. Let met try and break down down.

Content - A plain keyword, not a regex as per documentation some word (any word) is required. In this case you use the word content
as it will be in all email messages.

content-transfer-encoding: base64 - Must contain this phrase
content-disposition: inline - Must contain this phrase
(content-type: image/png)|(content-type: image/jpg) - Either of these
((text/plain)|(text/html))::NEGATE - Message must not be text/plain or text/html?

The NEGATE affects only the last REGEX? ]]> Thu, 04 Jun 2009 01:42:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6670&PID=12943&title=spam-with-png-attachments#12943 <![CDATA[Spam with PNG attachments : We&#039;ve pre-released SpamFilter...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6670&PID=12939&title=spam-with-png-attachments#12939 Author: LogSat
Subject: 6670
Posted: 03 June 2009 at 4:55am

We've pre-released SpamFilter v4.1.2.811 in the registered user area, and this version supports a variation in the keyword blacklist options that is helping in catching this spam. That release, along with the following keyword:

Content,(content-transfer-encoding: base64),(content-disposition: inline),((content-type: image/png)|(content-type: image/jpg)),((text/plain)|(text/html))::NEGATE

is helping in stopping this category of spam.]]> Wed, 03 Jun 2009 04:55:45 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6670&PID=12939&title=spam-with-png-attachments#12939 <![CDATA[Spam with PNG attachments : Has anyone made any progress on...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6670&PID=12938&title=spam-with-png-attachments#12938 Author: __M__
Subject: 6670
Posted: 02 June 2009 at 11:07pm

Has anyone made any progress on this?]]> Tue, 02 Jun 2009 23:07:35 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6670&PID=12938&title=spam-with-png-attachments#12938 <![CDATA[Spam with PNG attachments : I have the same problem as WebGuyz...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6670&PID=12912&title=spam-with-png-attachments#12912 Author: __M__
Subject: 6670
Posted: 20 May 2009 at 9:00pm

I have the same problem as WebGuyz and have confirmed that the ScanReceivedHeaders=1 setting is in my .ini file too.]]> Wed, 20 May 2009 21:00:21 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6670&PID=12912&title=spam-with-png-attachments#12912 <![CDATA[Spam with PNG attachments : Was already set to 1 ]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6670&PID=12909&title=spam-with-png-attachments#12909 Author: WebGuyz
Subject: 6670
Posted: 20 May 2009 at 5:28pm

Was already set to 1 Confused]]> Wed, 20 May 2009 17:28:27 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6670&PID=12909&title=spam-with-png-attachments#12909 <![CDATA[Spam with PNG attachments : Webguyz, Can you try changing...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6670&PID=12908&title=spam-with-png-attachments#12908 Author: LogSat
Subject: 6670
Posted: 20 May 2009 at 4:48pm

Webguyz,

Can you try changing the following setting in the SpamFilter.ini file to 1:

ScanReceivedHeaders=1
]]> Wed, 20 May 2009 16:48:25 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6670&PID=12908&title=spam-with-png-attachments#12908 <![CDATA[Spam with PNG attachments : LogSat wrote:We&#039;re working...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6670&PID=12900&title=spam-with-png-attachments#12900 Author: WebGuyz
Subject: 6670
Posted: 19 May 2009 at 10:34am

Originally posted by LogSat LogSat wrote:

We're working to try stopping this wave of spam with either a new filter or a reliable RegEx expression.

The base keyword expression we're working with is:

Content-Transfer-Encoding: base64,Content-Disposition: inline,Content-Type: image/png


 
I have this exact line and its not stopping the spam. Just got one myself today and verified that all 3 phrases are in the email, but it didn't stop it. Got a few more over the weekend as well from some customers. Is there some setting in the ini that I might not have set that would allow it to work on the format of the message, not just the text body??
]]> Tue, 19 May 2009 10:34:16 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6670&PID=12900&title=spam-with-png-attachments#12900 <![CDATA[Spam with PNG attachments : Just to confirm that we are also...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6670&PID=12896&title=spam-with-png-attachments#12896 Author: yapadu
Subject: 6670
Posted: 19 May 2009 at 6:00am

Just to confirm that we are also seeing an increased amount of this type of SPAM.  Interesting though, most of the messages appear to be blank, only the inline png image.

I don't understand why the blank email option is not kicking in, I thought it used to be a configurable option but I don't see it anywhere that can be configured on a per domain level.
]]> Tue, 19 May 2009 06:00:48 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6670&PID=12896&title=spam-with-png-attachments#12896 <![CDATA[Spam with PNG attachments : We&#039;re working to try stopping...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6670&PID=12894&title=spam-with-png-attachments#12894 Author: LogSat
Subject: 6670
Posted: 15 May 2009 at 4:02pm

We're working to try stopping this wave of spam with either a new filter or a reliable RegEx expression.

The base keyword expression we're working with is:

Content-Transfer-Encoding: base64,Content-Disposition: inline,Content-Type: image/png

However that is stopping a bit more legitimate emails we'd like and are trying to tweak it. It is however more reliable than stopping all the .png inline attachments by just having the (.*\.png).
]]> Fri, 15 May 2009 16:02:16 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6670&PID=12894&title=spam-with-png-attachments#12894