IMF Tune - Bringing Back the Exchange Connection Filter
July 26, 2007
The recent PDF spam wave has been bugging many of you. It is clear that IMF was caught on the wrong foot, and is classifying these with low SCL ratings. Thus we had to add some new filtering functionality to counter this problem.
One of the key characteristics of these emails is their empty body. Up till now IMF Tune was unable to filter emails based on this fact. However this is not the case any longer. The latest IMF Tune v3.0 build, includes a new type of condition under Advanced SCL Rules. The new condition type is shown below:
'Email has NO body text' will match all emails that either have an empty body or the body is entirely composed of non-textual elements. Thus this will also match emails that only contain images within the body (another typical spam trick).
Getting the Update
We are making the update available both as a patch and as part of the latest build number 126.96.36.199.
Follow this link to download the latest build.
Follow this link to download the patch.
Note that the patch can be applied only to IMF Tune build 3.0.107.02 and brings IMF Tune to build level 188.8.131.52.
The patch comes as a zip file and must be installed manually. The necessary installation steps are listed in the Readme.txt file included within the zip file.
Configuring a rule to block PDF spam
The following is the recommended configuration in order to counter the current PDF SPAM wave. Please verify that these settings are applicable to your organization requirements before saving changes.