Score on attachments

[Alex Neuman]

Or you could just let MailScanner do its job and not deliver these files -
along with the e-mails with the dangerous attachments.



*Alex Neuman van der Hans*Reliant Technologies / Vida Digital
http://vidadigital.com.pa/

Mobile: +507-6781-9505
Work: +507-832-6725
Work (USA): +1-440-253-9789
Skype: AlexNeuman

Don't miss Vida Digital on LiveStream
<http://new.livestream.com/accounts/5061819>!
Saturdays 8am-10am on 104.3FM Panama

Follow *@AlexNeuman <https://twitter.com/alexneuman>* on Twitter
Like Vida Digital <https://facebook.com/vidadigital/> on Facebook
Follow VidaDigital <http://instagram.com/vidadigital> on Instagram
Subscribe to Vida Digital <https://youtube.com/reliantpty> on Youtube


On Fri, Jun 27, 2014 at 4:16 PM, Max Kipness <max at inmindlabs.com> wrote:

>
> >What about not allowing messages with forbidden attachments through at
> all?
> >In any case, you might want to try something like this:
> >mimeheader SCR_ATTACHED Content-Type =~ /scr/i
> >describe SCR_ATTACHED email contains an scr file attachment
> >score SCR_ATTACHED 1.0
>
> I actually spoke a little soon.
>
> Although this works great on the actual SCR files. I realized later they
> are sent inside of zip files. This doesn't work for an SCR inside of a zip,
> of course because the mime header has no mention of the inside file.
>
> For now I'm giving zip files a low score, but enough to take the email to
> definite "is spam" with a Bayes 999.
>
> I'm also reviewing Rick's suggestion.
>
> Thanks all,
> Max
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20140627/5c52834b/attachment.html