image-only spam -- ideas, what to do?

[dhottinger at harrisonburg.k12.va.us]

Quoting John Villalovos <sodarock at gmail.com>:

> On 12/12/06, dhottinger at harrisonburg.k12.va.us
> <dhottinger at harrisonburg.k12.va.us> wrote:
>> Quoting John Villalovos <sodarock at gmail.com>:
>>> On 12/12/06, Bill McClain <wmcclain at salamander.com> wrote:
>>>> Bogofilter relies more on header information in these cases. I found it
>>>> useful to set "block_on_subnets=yes", which adds ip address information to
>>>> the database (and expands the database token count by about 20%).
>> Ip address
>>>> ranges can be very good discriminators.
>>>
>>> I add this to my /etc/procmailrc.  It adds a header if there is an
>>> inline image.
>>>
>>> :0 HB
>>> # If it has an inline image, put in a header to indicate so.
>>> * src=(3D)?\"cid:.*@.*\"
>>> {
>>>     :0 fwh
>>>     # Make sure space at end of header.
>>>     | formail -I"X-Inline-Image: "
>>> }
>>>
>>
>> You added that to your bogofilter config file?  Do I have to recompile
>> to add the subnet info?  My spamfilter is catching over 30000 emails a
>> day.  I have things set up so that my users (around 720) report emails
>> as spam.  Then I go through these emails and import them into
>> bogofilter with a little script.  Will the larger database be a
>> performance hit?
>
> As I said in my email.  I added that to my /etc/procmailrc
>
> John

Im sorry, yes I see that.  I mean the block_on_subnets for bogofilter.cf.

-- 
Dwayne Hottinger
Network Administrator
Harrisonburg City Public Schools