Comments on: Procmail rule to drop image-attachment spam?

Question: Procmail rule to drop image-attachment spam?

odinsdream — Sat, 10 Mar 2007 10:52:58 -0800

How can I write a procmail rule that would drop messages with GIF or JPEG attachments under 100kB in size?

The vast majority of junkmail I receive has image attachments. Sometimes I get real mail from friends with image attachments.

The difference is the file size. Spam attachments are rarely over 100kB, while real pictures from digital cameras are of course much larger.

How can I write a procmail rule to drop any messages with image attachments under a certain size?

By: frieze

frieze — Sat, 10 Mar 2007 11:35:38 -0800

What a great and simple idea. Sorry to say I don't have procmail skills, but since i use apple mail app I am going to write an applescript to do that. Good luck.

By: odinsdream

odinsdream — Sat, 10 Mar 2007 12:11:39 -0800

frieze, I also use apple mail most of the time, so if you come up with such a script, I would love to take a look at it.

By: nathan_teske

nathan_teske — Sat, 10 Mar 2007 12:29:58 -0800

Not to continue the hijack, but this mail filter nukes most image spam.

By: rpn

rpn — Sat, 10 Mar 2007 13:13:06 -0800

:0 B:
* Content-Type: image/gif
* < 100000
ImageSpam

This rule will put all mails that are smaller than 100000 bytes and contains an gif image (for other image types you can add more rules, changing image/gif to the appropriate mime-type, e.g. image/jpeg) into the folder ImageSpam. There is a way to specify OR commands, e.g. put different types in the same rule. Don't remember the syntax now though...

This rule will run a command searching for some text on the full e-mail - if you get many large mails it might be a bit slow.

By: Freaky

Freaky — Sat, 10 Mar 2007 19:41:57 -0800

Probably better just to do:

* ^Content-Type: image/

to match all attachments with an image type, and ignore the subtype. You can do something like image/(x-)?(jpeg|gif|png|bmp) or so if you really want - that'll specifically match image/jpeg, image/x-jpeg, etc.

If you need to whitelist something, remember you can do things like:

* !^From:.*bla@foo\.com

To specify a particular pattern should *not* match the rule. If you've got more complex needs, you can attach a set of subrules to try if a rule matches:

:0 B
* ^Content-Type: image/
* < 100000
* > 2000
{
  :0:
  * ^From: foo
  foo

  :0:
  * ^Subject: bar
  bar

  :0:
  ImageSpam
}

By: RustyBrooks

RustyBrooks — Sun, 11 Mar 2007 12:07:04 -0800

I've had the simple version of the rule going since it was posted, and it works great.

By: frieze

frieze — Mon, 12 Mar 2007 09:59:56 -0800

Yeah, the applescript thing wasn't that tricky at all. I had it move the files to another folder but the guy in the link just changed the color of the email in your inbox, which is actually a pretty cool idea.

(*set theOutputFolder to (choose folder) as string
*)
using terms from application "Mail"
on perform mail action with messages theSelectedMessages for rule theRule
tell application "Mail"
repeat with eachMessage in theSelectedMessages
set theAttachments to every mail attachment of eachMessage
set numAttachments to length of theAttachments

if numAttachments is equal to 1 then

set theAttachment to item 1 of theAttachments
set attachmentType to (MIME type of theAttachment)
set attachmentSize to (file size of theAttachment)

if attachmentType is equal to "image/gif" then
if attachmentSize is less than 100000 then
move eachMessage to mailbox "picspam"
end if
end if
end if
end repeat
end tell
end perform mail action with messages
end using terms from

P.S. It was easy because I cribbed 90% of the code from 2 code examples.