image-only spam -- ideas, what to do?

[John Villalovos]

On 12/12/06, dhottinger at harrisonburg.k12.va.us
<dhottinger at harrisonburg.k12.va.us> wrote:
> Quoting John Villalovos <sodarock at gmail.com>:
> > On 12/12/06, Bill McClain <wmcclain at salamander.com> wrote:
> >> Bogofilter relies more on header information in these cases. I found it
> >> useful to set "block_on_subnets=yes", which adds ip address information to
> >> the database (and expands the database token count by about 20%). Ip address
> >> ranges can be very good discriminators.
> >
> > I add this to my /etc/procmailrc.  It adds a header if there is an
> > inline image.
> >
> > :0 HB
> > # If it has an inline image, put in a header to indicate so.
> > * src=(3D)?\"cid:.*@.*\"
> > {
> >     :0 fwh
> >     # Make sure space at end of header.
> >     | formail -I"X-Inline-Image: "
> > }
> >
>
> You added that to your bogofilter config file?  Do I have to recompile
> to add the subnet info?  My spamfilter is catching over 30000 emails a
> day.  I have things set up so that my users (around 720) report emails
> as spam.  Then I go through these emails and import them into
> bogofilter with a little script.  Will the larger database be a
> performance hit?

As I said in my email.  I added that to my /etc/procmailrc

John