A Mail.app rule for catching image spam

Thanks for the tip.

Another tip from me is to use larger calibers than 9mm on spammers...aim for their feet...

For the people using SpamSieve, there is a good and free alternative: JunkMatcher. It also uses Bayesian filtering plus a set of other rules that are regularly updated.

hmm doesn't seem to work. Must not be a header, but some other heading.

I do have one out of thousands of emails that use that kind of content type in my current saved emails, so I suppose it's not too bad at false positives. However I wonder if there is a way to simply filter out messages that contain base 64 stuff?

Would

Content-Transfer-Encoding (is equal to) base64

work?

Is this less of a false positive risk?

This is a great tip... I've set it up in Thunderbird as a separate rule also matching people who are not in my personal address book and so far it has worked a treat. I've been getting those stupid mails daily for months and I'd love some hacker to track them down and burn them good. I never knew about being able to create the Content-Type option before. I'm rapt!

Aha! Thanks, Andy - I should have read the Hawk Wings post properly ;-)

[Later...]

Well, it's just caught all of those annoying spam mails that always land in my inbox when I fire up Mail each morning, so that's a plus. No false positives yet, so fingers crossed...

It's true you do need to check for false positives, but simply drag these back to the inbox to accept them as "previous recipients", so that future messages from this sender will be accepted as well.

Thanks for this rule hint as I get some of this mail and it is time consuming deleting it, this may help
Thanks greatly
JJ

I've posted a guide for doing this in Mozilla Thunderbird here:
http://www.neilturner.me.uk/2006/Aug/06/stopping_image_spam_in_th.html

It's actually pretty much the same. Can't be done in Outlook Express though.

It is typically wise if you unfortunately get a lot of spam (I get about 1000 messages a day now due to having some public email addresses of necessity) to direct the results of this rule not to your general junk directory but to a secondary junk directory. I call mine A-Spam.

The reason is that it makes it much easier to look for false positives.