One of the things that I've done in the past was to configure spamassassin to mark email as spam if it contains more than x% of images. You get some false positives, but unless you are just trashing them, then you can tell your users to check their junk mail folders regularly.
<br><br>
<div><span class="gmail_quote">On 4/27/06, <b class="gmail_sendername">Matt Patterson</b> <<a href="mailto:matt@usrlocal.com">matt@usrlocal.com</a>> wrote:</span>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">This looks like a message that my company (MailFoundry) refers to as gif spams. It is a different<br>beast than the typical spam and has been challenging (but not impossible) to stop. Most of
<br>these spam messages are a simple image talking about a hot new crappy stock that is expected<br>to go big in the next few days. There is no link to click. The call to action is that you are getting<br>the information in hopes that you go to a site and buy the stocks.
<br><br>We're starting to see more of these with the watches and mortgages loan scams as well.<br><br>It's one of the newer trends of spam messages.<br><br>Matt Patterson<br><a href="mailto:matt@usrlocal.com">matt@usrlocal.com
</a><br><br><br><br>On Thu, 27 Apr 2006 7:27:56 -0600 (CST), "Nathan C. Smith" <<a href="mailto:smith@ipmvs.com">smith@ipmvs.com</a>> wrote:<br>><br>> Looks like they want to see if the message gets opened in an HTML mail
<br>> reader to see if the address really exists. Look up SPAM beacon.<br>><br>> > -----Original Message-----<br>> > From: Stephen Hawkins [mailto:<a href="mailto:ng0g@mchsi.com">ng0g@mchsi.com</a>]=20<br>
> > Sent: Thursday, April 27, 2006 6:12 AM<br>> > To: Central Iowa Linux Users Group<br>> > Subject: [Cialug] odd spam<br>> >=20<br>> >=20<br>> > CIALUG,<br>> >=20<br>> > I have been getting several emails like this a day for the=20
<br>> > past two days. The=20<br>> > address contained in the html body of the email is not always=20<br>> > the same, but=20<br>> > the rest of the body is always the same.<br>> >=20<br>> > I keep my email program set on text only.
<br>> > Any idea what kind of scam is going on here.<br>> >=20<br>> > Thanks,<br>> > Steve<br>> >=20<br>> > --------------------------------------------------example-----<br>> > --------------------------------
<br>> > > Received: from pool-151-196-52-48.balt.east.verizon.net=20<br>> > > ([<a href="http://151.196.52.48">151.196.52.48</a>])<br>> > > =A0 =A0 =A0 =A0 =A0 by <a href="http://sccqmxc92.asp.att.net">
sccqmxc92.asp.att.net</a> (sccqmxc92) with SMTP<br>> > > =A0 =A0 =A0 =A0 =A0 id <20060427104152q9200861aee>; Thu, 27 Apr 2006=20<br>> > 10:41:52 +0000<br>> > > X-Originating-IP: [<a href="http://151.196.52.48">
151.196.52.48</a>]<br>> > > Received: from wd.zvhr ([<a href="http://151.196.82.36">151.196.82.36</a>])<br>> > > =A0=A0=A0=A0=A0=A0=A0=A0by pool-151-196-52-48.balt.east.verizon.net=20<br>> > (8.13.1
/8.13.1) with<br>> > > SMTP id k3RAijSp061877; Thu, 27 Apr 2006 06:44:45 -0400<br>> > > Message-ID: <<a href="mailto:002001c669e7$2d8cecf9$2452c497@wd.zvhr">002001c669e7$2d8cecf9$2452c497@wd.zvhr</a>
><br>> > > From: "Becky Crow" <<a href="mailto:kmplp@stantontechnologies.com">kmplp@stantontechnologies.com</a>><br>> > > To: <<a href="mailto:ng0g@mchsi.com">ng0g@mchsi.com</a>>
<br>> > > Subject: broadcast mud<br>> > > Date: Thu, 27 Apr 2006 06:41:11 -0400<br>> > > MIME-Version: 1.0<br>> > > Content-Type: multipart/related;<br>> > > =A0 type=3D"multipart/alternative";
<br>> > > =A0 boundary=3D"----=3D_NextPart_000_001C_01C669C5.A67B4CA5"<br>> > > X-Priority: 3<br>> > > X-MSMail-Priority: Normal<br>> > > X-Mailer: Microsoft Outlook Express
6.00.2800.1409<br>> > > X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409<br>> > > Status: R<br>> > > X-Status: NT<br>> > > X-KMail-EncryptionState:<br>> > > X-KMail-SignatureState:
<br>> > > X-KMail-MDN-Sent:<br>> > ><br>> > > Note: This is an HTML message. For security reasons, only=20<br>> > the raw HTML=20<br>> > > code is shown. If you trust the sender of this message then you can=20
<br>> > > activate formatted HTML display for this message by clicking here.<br>> > ><br>> > ><br>> > > <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">=20
<br>> > > <HTML><HEAD> <META http-equiv=3DContent-Type content=3D"text/html;=20<br>> > > charset=3Dwindows-1252"> <META content=3D"MSHTML 6.00.2800.1409"=20<br>> > > name=3DGENERATOR> <STYLE></STYLE>
<br>> > > </HEAD><br>> > > <BODY bgColor=3D#ffffff><br>> > > <DIV><FONT face=3DArial size=3D2><IMG alt=3D"" hspace=3D0<br>> > > src=3D"<a href="mailto:cid:001b01c669e7$2d8cec90$2452c497@wd.zvhr">
cid:001b01c669e7$2d8cec90$2452c497@wd.zvhr</a>" align=3Dbaseline<br>> > > border=3D0></FONT></DIV><br>> > > </BODY></HTML><br>> > > acquainted.gif<br>> > ----------------------------------------------------end-------
<br>> -----------------------------------<br>> >=20<br>> >=20<br>> > --=20<br>> > 73 49 111 01001001<br>> > Steve Hawkins NG0G<br>> > <a href="mailto:ng0g@arrl.net">ng0g@arrl.net</a>
<br>> > _______________________________________________<br>> > Cialug mailing list<br>> > <a href="mailto:Cialug@cialug.org">Cialug@cialug.org</a><br>> > <a href="http://cialug.org/mailman/listinfo/cialug">
http://cialug.org/mailman/listinfo/cialug</a><br>> >=20<br>> _______________________________________________<br>> Cialug mailing list<br>> <a href="mailto:Cialug@cialug.org">Cialug@cialug.org</a><br>> <a href="http://cialug.org/mailman/listinfo/cialug">
http://cialug.org/mailman/listinfo/cialug</a><br>><br>><br><br><br><br>_______________________________________________<br>Cialug mailing list<br><a href="mailto:Cialug@cialug.org">Cialug@cialug.org</a><br><a href="http://cialug.org/mailman/listinfo/cialug">
http://cialug.org/mailman/listinfo/cialug</a><br></blockquote></div><br>