Dealing with embedded GIF spam

embedded GIF SPAMSpam and phishing emails can be a huge drain on productivity for an Internet based business. I use Mozilla Thunderbird and I find the spam filtering works tolerably well. Most of the incoming spam is quietly siphoned off into a ‘Junk’ folder and there appear to be very few false positives. I supplement this with a message filter to move all emails purporting to be from paypal.com or ebay.com (99% of which are phishing emails) to a ‘Suspicious’ folder, which I check from time to time. But I still get lots of spam with embedded GIF images, which Thunderbird’s spam filter seems to be powerless to handle.

Mostly these are ‘pump and dump’ stock tips, but some of them are for viagra, cialis etc. Some of the spammers even helpfully include images of the body parts targeted by these medications. After a quick Google I found out how to set up a message filter for embedded GIFs on Uzik’s blog. Any email with an embedded GIF that comes from someone I don’t know now gets sent to my ‘Suspicious’ folder. Thanks Uzik! A similar approach should work in many other email clients.

Thunderbird embedded GIF rule

a rule for embedded GIFs (click to enlarge), see Uzik’s blog for more details

Note that some legitimate emails may have embedded GIFs as background images. While this practice is highly questionable you won’t want to lose these emails, so you should check your ‘Suspicious’ folder from time to time.

Of course this is only partial solution. The only real solution is to stop the spam in the first place. I say cut off their goolies.

9 Responses to “Dealing with embedded GIF spam”


  1. 1 Andrea Nagar 14 April 2007 at 8:10 pm

    I use Google App for domains and I have my mail going through google mail server. I receive almost 0 spam and almost no false positive. Their filters seems to work very well (they are filtering out more than 4000 spams/month on my accounts).

  2. 2 Andy Brice 15 April 2007 at 8:21 am

    Sounds interesting. But I am already dependent of Google for search, advertising, analytics and soon payment processing. I am not sure I want them hosting my email as well!

  3. 3 Dave 16 April 2007 at 4:05 am

    I have been using MailWasher Pro for about 2 years now and find it to be a great way to filter email before it even gets to my inbox.

    I read the header in MailWasher and then ‘process’ the list of spam/friends etc. It’s got SpamCop, FirstAlert and other online hooks to spam databases.

    http://www.firetrust.com

  4. 4 Patrick 16 April 2007 at 5:02 am

    >>
    Note that some legitimate emails may have embedded GIFs as background images.
    >>

    MANY of my emails have this feature, principally ones from automated systems at, e.g., my brokerage, Paypal confirmations, yadda yadda. I have a PopFile filter trained to recognize these and other automatically sent but still important email. Anything that gets tagged with that gets moved out of my “Never check it” suspicious folder to my “Eh, if I’m very bored” correspondence-with-a-computer folder.

  5. 5 Rob Drimmie 16 April 2007 at 6:42 pm

    Hi Andy,

    Thanks for starting the blog, already there’s been tons of great information.

    Would it be possible to either switch your current feed to full entries, or add an additional feed that contains the whole thing?

  6. 6 Andy Brice 16 April 2007 at 10:31 pm

    Rob,

    Splitting the post into an intro+more seems to work well when it is syndicated to planetmicroisv.com .

    Is it easy to create a second feed with wordpress?

  7. 7 Andy Brice 16 April 2007 at 10:34 pm

    Patrick,

    I think the PayPal images are linked, rather than embedded. certainly they don’t get picked up by my embedded gif rule.

    In fact the only false positive so far is someone from the wedding industry who had a vile background image (which made their email almost impossible to read anyway).

  8. 8 Rob Drimmie 21 April 2007 at 5:39 pm

    Andy, unfortunately I don’t know enough about WordPress to be able to say.

  9. 9 Andy Brice 21 April 2007 at 5:44 pm

Leave a Reply