Procmail rule to drop image-attachment spam?

March 10, 2007 10:52 AM

How can I write a procmail rule that would drop messages with GIF or JPEG attachments under 100kB in size?

The vast majority of junkmail I receive has image attachments. Sometimes I get real mail from friends with image attachments.

The difference is the file size. Spam attachments are rarely over 100kB, while real pictures from digital cameras are of course much larger.

How can I write a procmail rule to drop any messages with image attachments under a certain size?

posted by odinsdream to computers & internet (7 comments total)

What a great and simple idea. Sorry to say I don't have procmail skills, but since i use apple mail app I am going to write an applescript to do that. Good luck.
posted by frieze at 11:35 AM on March 10, 2007

frieze, I also use apple mail most of the time, so if you come up with such a script, I would love to take a look at it.
posted by odinsdream at 12:11 PM on March 10, 2007

Not to continue the hijack, but this mail filter nukes most image spam.
posted by nathan_teske at 12:29 PM on March 10, 2007

:0 B:
* Content-Type: image/gif
* < 100000
ImageSpam


This rule will put all mails that are smaller than 100000 bytes and contains an gif image (for other image types you can add more rules, changing image/gif to the appropriate mime-type, e.g. image/jpeg) into the folder ImageSpam. There is a way to specify OR commands, e.g. put different types in the same rule. Don't remember the syntax now though...

This rule will run a command searching for some text on the full e-mail - if you get many large mails it might be a bit slow.
posted by rpn at 1:13 PM on March 10, 2007

Probably better just to do:

* ^Content-Type: image/

to match all attachments with an image type, and ignore the subtype. You can do something like image/(x-)?(jpeg|gif|png|bmp) or so if you really want - that'll specifically match image/jpeg, image/x-jpeg, etc.

If you need to whitelist something, remember you can do things like:

* !^From:.*bla@foo\.com

To specify a particular pattern should *not* match the rule. If you've got more complex needs, you can attach a set of subrules to try if a rule matches:

:0 B
* ^Content-Type: image/
* < 100000
* > 2000
{
  :0:
  * ^From: foo
  foo

  :0:
  * ^Subject: bar
  bar

  :0:
  ImageSpam
}
posted by Freaky at 7:41 PM on March 10, 2007

I've had the simple version of the rule going since it was posted, and it works great.
posted by RustyBrooks at 12:07 PM on March 11, 2007

Yeah, the applescript thing wasn't that tricky at all. I had it move the files to another folder but the guy in the link just changed the color of the email in your inbox, which is actually a pretty cool idea.

(*set theOutputFolder to (choose folder) as string
*)
using terms from application "Mail"
on perform mail action with messages theSelectedMessages for rule theRule
tell application "Mail"
repeat with eachMessage in theSelectedMessages
set theAttachments to every mail attachment of eachMessage
set numAttachments to length of theAttachments

if numAttachments is equal to 1 then

set theAttachment to item 1 of theAttachments
set attachmentType to (MIME type of theAttachment)
set attachmentSize to (file size of theAttachment)

if attachmentType is equal to "image/gif" then
if attachmentSize is less than 100000 then
move eachMessage to mailbox "picspam"
end if
end if
end if
end repeat
end tell
end perform mail action with messages
end using terms from

P.S. It was easy because I cribbed 90% of the code from 2 code examples.
posted by frieze at 9:59 AM on March 12, 2007