What's different with the new PDF only spams?

Leland J. Steinke steinkel at pa.net
Wed Aug 8 14:39:05 IST 2007

Steve Campbell wrote:
> Now, the rule seem to be insufficient and is letting a lot of the newer 
> ones through. I'm not a RegEx expert, to be sure, so can any one offer a 
> suggestion for a rule to stop this new wave PDF-Only mailings, please?

If you are running SA3.2.2, you can jack up the score for 
GMD_PDF_EMPTY_BODY.  There is also GMD_PDF_ENCRYPTED which is hitting on 
a number of the messages getting past the PDF_ONLY_SPAM rule.  I 
upgraded from 3.1.7 last week, so I do not know when those rules were added.


More information about the MailScanner mailing list