Another Mail.app rule to catch image spam
A poster on macOSXHints has described a rule 
designed to block the current plague of image-bearing spam.
It’s an improvement, perhaps, on the image spam catching rule I posted three months ago.
Having read the post and the suggestion in the comments, I’ve tweaked my rule for this a bit.
It now looks like this:
Most of the image spam I get contains a GIF file.
I like the idea of setting the colour to a particular colour so that I can see at a glance which messages the rule has moved. It gives a warm fuzzy feeling and it helps me to scan quickly for false positives.
Tags: Apple Mail, Apple Mail Tips, cads and bounders, image spam, Junk, mail.app, rules, spamRelated posts
December 20th, 2006 at 1:42 am
Thanks
Just minutes after I set up a rule like you have i received a spam message with matced excactly.
- It had a .gif
- I was multipart/related (Raw source read: Content-Type: multipart/related;)
- Was not in my address book
…but Mail didn’t catch it. I found it was the Content-Type because as I deleted that condition Mail caught it.
Any idea why ?
December 20th, 2006 at 4:05 am
I don’t have an option for Content-Type in the selecting the rules. The only option I have for Content is Message Content and then whether it Contains, Does Not Contain, Begins With, Ends With, or Is Equal To. I’m running version 2.1 (752/752.2) under OS X 10.4.7. Checks for software updates reveal there are none.
December 20th, 2006 at 9:04 am
At the bottom of the rules drop down you can “Edit Header List…” and add it.
December 21st, 2006 at 10:01 am
I have tried at least two other versions of similar rules to catch those boring spam messages. Then I tried for SpamSieve for two weeks and after it had cought every one of this kind of spam I bought it. I feel like a free man again. It’s even fun to get spam now and see it stashed in one folder called Spam without me hardly moving a finger.
December 22nd, 2006 at 10:54 pm
I don’t have image spam because I use DSpam, it is learning very quickly in adapting. Together with the standard Junk rules in my mail program they train each other and are a perfect solution I’m almost 99% free of spam. The only issue might be is that you need to run your own mailserver…
December 23rd, 2006 at 9:32 am
Dude, best Christmas gift I’ve gotten yet! Thank you so much.
December 23rd, 2006 at 11:02 am
I use JunkMatcher (free, PPC only) and it has now learn to effectively catch all those image spams as well.
January 11th, 2007 at 1:58 am
Torben wrote: “Just minutes after I set up a rule like you have i received a spam message with matced excactly.
- It had a .gif
- I was multipart/related (Raw source read: Content-Type: multipart/related;)
- Was not in my address book
…but Mail didn’t catch it. I found it was the Content-Type because as I deleted that condition Mail caught it.
Any idea why ?”
Here is my guess. You did not include a “Stop Evaluating Rules” at the end, which actually should be added to the example above. What may be happening is that a subsequent rule is overriding the actions of this rule. Hope that helps.
March 8th, 2007 at 7:10 pm
I created this rule, but now I cannot edit it nor can I edit any copies of it.
odd huh?
Using version 1.3.11 with mac osx 10.3.9
I can delete it so I’m not that concerned, but it is curious.
any ideas?
March 13th, 2007 at 3:57 am
I just wrote an applescript and had it run whenever a message is not from someone in my address book. This way I can adjust the filter to only work emails that contain exactly one small gif image.
(*set theOutputFolder to (choose folder) as string
*)
using terms from application "Mail"
on perform mail action with messages theSelectedMessages for rule theRule
tell application "Mail"
repeat with eachMessage in theSelectedMessages
set theAttachments to every mail attachment of eachMessage
set numAttachments to length of theAttachments
if numAttachments is equal to 1 then
set theAttachment to item 1 of theAttachments
set attachmentType to (MIME type of theAttachment)
set attachmentSize to (file size of theAttachment)
if attachmentType is equal to "image/gif" then
if attachmentSize is less than 100000 then
move eachMessage to mailbox "picspam"
end if
end if
end if
end repeat
end tell
end perform mail action with messages
end using terms from