Spamassassin Blank body & PDF attachments

matt1982 · 07-25-2007, 10:24 AM

Hi guys,

I've been adding rules to my local.cf file, which obviously I maintain, but recently I've been getting a large amount of SPAM comming in with .pdf attachments and blank lines in the body.

I'm digging hard on google and i'm trying to come up with a rule that if an email comes in with a pdf attachment and a blank body to mark it as SPAM....

Anyone have any ideas, i'm really getting frustrated... :P

Thanks ahead for the help

Matt

bigrigdriver · 07-25-2007, 01:54 PM

Try the SpamAssassin Wiki. They have some custom rulesets that you can download, use, and modify to your hearts content.

Get them here: http://wiki.apache.org/spamassassin/ThirdPartySoftware

matt1982 · 07-25-2007, 02:41 PM

Thanks, I've been checking out that site today, but the only thing I have found for scanning pdf attachments is by installing a plugin on my spamassassin and then use rules to work with it.

Is there now was to have a rule check an attachment, ie a pdf with blank body?

Still searching...., thanks though for the link

matt1982 · 07-26-2007, 09:58 AM

How about just a rule that checks for blank body, how would I do this?... I know how to have it check for words, sentences, but empty body... ??

hmm... THANKS

Wells · 07-27-2007, 09:55 AM

Hrm... looking at the raw source for one of these, you have two different sections:

Quote:

Content-Type: text/plain; charset=windows-1250; format=flowed
Content-Transfer-Encoding: 7bit

--------------060802040601060307000504

And...

Quote:

Content-Type: application/pdf;

After the pdf content type is defined you get your standard mime-encoded PDF file. Now, it seems to me that you can scan for a message that has both a PDF and a text section, and if the text section happens to hold nothing but carriage returns, you can flag that one as spam.