[Mimedefang] PDF spam

[Jim McCullars]

On Fri, 27 Jul 2007, Kevin A. McGrail wrote:

> I'm also using the PDFInfo.pm by Dallas with good success.  There is one

   So am I.  It seems that all of the PDF spam we have been getting had
encrypted PDF files as an attachment (probably so that they couldn't be
examined by spam filters) and empty text parts.  Ergo, we look for hits on
the GMD_PDF_EMPTY_BODY and GMD_PDF_ENCRYPTED rules and reject with a
message to include body text when sending an encrypted PDF.  This
particular check will probably be obsolete within a few days but it sure
has worked out since we implemented it.

Jim McCullars
University of Alabama in Huntsville