image-only spam -- ideas, what to do?

[dhottinger at harrisonburg.k12.va.us]

Quoting John Villalovos <sodarock at gmail.com>:

> On 12/12/06, Bill McClain <wmcclain at salamander.com> wrote:
>> Bogofilter relies more on header information in these cases. I found it
>> useful to set "block_on_subnets=yes", which adds ip address information to
>> the database (and expands the database token count by about 20%). Ip address
>> ranges can be very good discriminators.
>
> I add this to my /etc/procmailrc.  It adds a header if there is an   
> inline image.
>
> :0 HB
> # If it has an inline image, put in a header to indicate so.
> * src=(3D)?\"cid:.*@.*\"
> {
>     :0 fwh
>     # Make sure space at end of header.
>     | formail -I"X-Inline-Image: "
> }
> _______________________________________________
> Bogofilter mailing list
> Bogofilter at bogofilter.org
> http://www.bogofilter.org/mailman/listinfo/bogofilter
>

You added that to your bogofilter config file?  Do I have to recompile  
to add the subnet info?  My spamfilter is catching over 30000 emails a  
day.  I have things set up so that my users (around 720) report emails  
as spam.  Then I go through these emails and import them into  
bogofilter with a little script.  Will the larger database be a  
performance hit?

-- 
Dwayne Hottinger
Network Administrator
Harrisonburg City Public Schools