Unstoppable picture spam.

[Søren Jacob Lauritsen]

Hello there!

Four times a day since the end of April, I have been blessed with
e-mails containing text as pictures. I'm pretty sure they're from the
same source. They all share the same "look": Text on a colored
background (light red or light green). The contents of the text differs
from time to time.

Have anybody received these e-mails? The spammer seems to be
unstoppable. So any suggestions would be nice. It's the first time, I
haven't been able to stop them within a few days.

Best regards,
Søren

[DougW]

Post by Søren Jacob Lauritsen
Hello there!
Four times a day since the end of April, I have been blessed with
e-mails containing text as pictures. I'm pretty sure they're from the
same source. They all share the same "look": Text on a colored
background (light red or light green). The contents of the text differs
from time to time.
Have anybody received these e-mails? The spammer seems to be
unstoppable. So any suggestions would be nice. It's the first time, I
haven't been able to stop them within a few days.

Most of mine is for pump&dump (stock scam) but there are
several gangs out there that put the links in picutures to
avoid filtering.

Recent ones were caught by the Spamhaus SBL/XBL or Spamcop.
(I use SpamPal locally)

[Berny]

Post by Søren Jacob Lauritsen
Hello there!
Four times a day since the end of April, I have been blessed with
e-mails containing text as pictures. I'm pretty sure they're from the
same source. They all share the same "look": Text on a colored
background (light red or light green). The contents of the text differs
from time to time.
Have anybody received these e-mails? The spammer seems to be
unstoppable. So any suggestions would be nice. It's the first time, I
haven't been able to stop them within a few days.
Best regards,
Søren
--
Remove nospam to write me! :-)

Light artillery would be sufficient

[anon]

Post by Søren Jacob Lauritsen
Hello there!
Four times a day since the end of April, I have been blessed with e-mails
containing text as pictures. I'm pretty sure they're from the same source.
They all share the same "look": Text on a colored background (light red or
light green). The contents of the text differs from time to time.

I think that the first thing you should do (not do) is about READING spams.

NEVER, NEVER, EVER *open* a spam - many spams 'phone home' to tell the
spammer that he has a 'live one' and the address is a salable commodity and
worth money to other spammers.

Also, never 'unsubscribe' to something you never subscribed to (same reason
as above.)

If you MUST read the spam - either disconnect from the web before opening it
to prevent communication. BUT realize that some spam may contain malicious
code that nesses up your hard drive.

Alternate method of looking at spam - in outlook express right click on spam
listed in mailbox, click on properties -> click on details tab -> click on
message source button.

This will give you all the information about the spam (but does not decode
base64 which looks like gibberish) - you can then see the complete headers
and the (possible) html coding.
--
A SpamCop user and forum reader,
Not Admin

Post by Søren Jacob Lauritsen
Have anybody received these e-mails? The spammer seems to be unstoppable.
So any suggestions would be nice. It's the first time, I haven't been able
to stop them within a few days.
Best regards,
Søren
--
Remove nospam to write me! :-)

[Søren Jacob Lauritsen]

Post by anon
I think that the first thing you should do (not do) is about READING spams.
NEVER, NEVER, EVER *open* a spam - many spams 'phone home' to tell the
spammer that he has a 'live one' and the address is a salable commodity
and worth money to other spammers.

I use gmail. It will never open any pictures. Besides that, I've checked
the e-mail file. The picture is an attachment. It's not an HTML e-mail.

Regards
Soeren

[anon]

Post by Søren Jacob Lauritsen

Post by anon
I think that the first thing you should do (not do) is about READING spams.
NEVER, NEVER, EVER *open* a spam - many spams 'phone home' to tell the
spammer that he has a 'live one' and the address is a salable commodity
and worth money to other spammers.

I use gmail. It will never open any pictures. Besides that, I've checked
the e-mail file. The picture is an attachment. It's not an HTML e-mail.

No, I mean do not open the spam at all (not talking about pictures or
anything else) - just do not open it at all.

Many times the mail does not 'look' like html, but if there is any
formatting - then it is html. If it is html then it is very easy for the
spammer to imbed a one pixel bit into the spam e-mail that DOES 'mail home'
when you open it - you can't see the one pixel bit on the screen but it is
there anyway.

Many people (unknowingly) send ordinary e-mails to their friends as html
mail because that is the default method when the mail programs are installed
on the computers.
--
A SpamCop user and forum reader,
Not Admin

Post by Søren Jacob Lauritsen
Regards
Soeren
--
Remove nospam to write me! :-)

[Asterix]

Post by anon

Post by Søren Jacob Lauritsen

Post by anon
I think that the first thing you should do (not do) is about READING spams.
NEVER, NEVER, EVER *open* a spam - many spams 'phone home' to tell the
spammer that he has a 'live one' and the address is a salable commodity
and worth money to other spammers.

I use gmail. It will never open any pictures. Besides that, I've checked
the e-mail file. The picture is an attachment. It's not an HTML e-mail.

No, I mean do not open the spam at all (not talking about pictures or
anything else) - just do not open it at all.

Please tell me how to report spam without opening it (and make sure it's
spam. By the way, it's years since I saw a web bug (fone home thingy).

[Mike Easter]

Post by Asterix
Please tell me how to report spam without opening it (and make sure
it's spam. By the way, it's years since I saw a web bug (fone home
thingy).

My spam is 'combed' by SpamPal so that it is tagged with a spam label in
its subject and given header Xlines defining how the spam was so
categorized before it arrives at my mua OE. OE puts the spamtagged
items into the Junk folder. If I want to see why an item was tagged, I
can examine its header Xlines by looking at its message properties
without opening it.

If I should really want to know more about what it inside, I can examine
the rest of its message properties including the unrendered body 'with
my own eyes'. That process is of course slower and less sophisticated
than how SpamPal has already more thoroughly examined it while accessing
spam database DNSBL lookups as well as churning through the body using
regular expression conditions far too complex to be performed by a mere
human brain.

Opening a spam to find out what is inside is a practice I discourage
except in some kind of 'advanced' spamfighting and then only for some
very good reason, perhaps 'teaching' spam forensics or something. It is
far too often performed by those who are simply curious spamhandlers.

The concept of opening a spam to find out if it is spam is totally
foreign to me.

[Asterix]

Post by Mike Easter

Post by Asterix
Please tell me how to report spam without opening it (and make sure
it's spam. By the way, it's years since I saw a web bug (fone home
thingy).

My spam is 'combed' by SpamPal so that it is tagged with a spam label in
its subject and given header Xlines defining how the spam was so
categorized before it arrives at my mua OE. OE puts the spamtagged
items into the Junk folder. If I want to see why an item was tagged, I
can examine its header Xlines by looking at its message properties
without opening it.

Sorry, I was actually mocking "anon" - most of my spam is also marked,
either by SpamAssasin or PerlMx-Spam depending on the mail server.
As I a) want full control of what I report and b) always report through
the web site, there is no way I can avoid opening the spam.

Besides, your reply says abolutely nothing about how to *report* spam,
which what I asked. And you don't say *why* you discourage opening spam,
though I think I have an idea.

However, in my world adware, spyware, trojans, worms and viruses are
a non-issue so I have no problem opening and reporting every spam.
For that matter, OE is a non-issue in my world, too :-)

[Mike Easter]

Post by Mike Easter
Mike Easter

Post by Mike Easter

Post by Asterix
Please tell me how to report spam without opening it (and make sure
it's spam.

If I want to see why an item
was tagged, I can examine its header Xlines by looking at its
message properties without opening it.

As I a) want full control of what I report and b) always report
through the web site, there is no way I can avoid opening the spam.

If you are saying that your software prohibits you from reporting spam
without opening it, I can't very well tell you how to report spam
without opening it.

Post by Mike Easter
Besides, your reply says abolutely nothing about how to *report* spam,
which what I asked.

No, you asked "and make sure it's spam" in addition to not saying what
method you were using to report.

Post by Mike Easter
And you don't say *why* you discourage opening
spam, though I think I have an idea.

I think I'll go into that on Nigel's post instead of here.

[Asterix]

Post by Mike Easter

Post by Mike Easter
Mike Easter

Post by Mike Easter

Post by Asterix
Please tell me how to report spam without opening it (and make sure
it's spam.

If I want to see why an item
was tagged, I can examine its header Xlines by looking at its
message properties without opening it.

As I a) want full control of what I report and b) always report
through the web site, there is no way I can avoid opening the spam.

If you are saying that your software prohibits you from reporting spam
without opening it, I can't very well tell you how to report spam
without opening it.

I didn't say my software prohibits me - it's rather Spamcop's web form.
Eudora lets me forward the spam to a sumbission address without
inspection, but then I completely lose control of where the reports go.
Examining the X-lines is of limited or no interest for that purpose.

I'm more concerned about not reporting "innocent bystander'
- and/or joe-job - web links in the body.
And making sure that real spamvertized links get parsed.
How can I do *that* without opening and reading the spam?
Or just use the web form at all without opening the spam?

Post by Mike Easter

Post by Mike Easter
Besides, your reply says abolutely nothing about how to *report* spam,
which what I asked.

No, you asked "and make sure it's spam" in addition to not saying what
method you were using to report.

The last part was my mistake - I use the web form exclusively.
However, I feel you *should* have seen what I meant - i'll try to
rephrase it:
"How do I report spam without opening it - being sure it is really spam
I'm reporting?"

Post by Mike Easter

Post by Mike Easter
And you don't say *why* you discourage opening
spam, though I think I have an idea.

I think I'll go into that on Nigel's post instead of here.

As far as I can tell you didn't. You just repeat *what* you don't
recommend - not *why*. As if spam inspection was some kind of black
magic that only you can master.
And you didn't tell Nigel that the site http://www.thestocktongroup.com/
is alive and kicking (maybe it wasn't yesterday) whether Spamcop
resolves the link or not. Actually it does today - to my surprise.

I thought it might be on a "bulletproof" domain that block DNS queries
from SC. Sometimes I get the feeling that some spamvertized sites are
not online - or even in DNS - until a day or two *after* the spam is
sent. Quite an elabotate scheme to dodge reports.

[anon]

Post by Asterix

Post by Mike Easter

Post by Mike Easter
Mike Easter

Post by Asterix
Please tell me how to report spam without opening it (and make sure
it's spam.

<clip>

Post by Asterix

Post by Mike Easter
No, you asked "and make sure it's spam" in addition to not saying what
method you were using to report.

The last part was my mistake - I use the web form exclusively.
However, I feel you *should* have seen what I meant - i'll try to
"How do I report spam without opening it - being sure it is really spam
I'm reporting?"

I think there is semantics problem here.

"Be sure it is spam" - by definition spam is unsolicited mail (mail you did
not request) - the definition does not say anything about content (therefore
you do not have to read the spam to see what it says.)

Either you requested the mail or you did not request the mail - unrequested
= unsolicited = spam. Mail from your friends is always "requested" mail.
--
A SpamCop user and forum reader,
Not Admin

Post by Asterix

Post by Mike Easter

Post by Mike Easter
And you don't say *why* you discourage opening
spam, though I think I have an idea.

I think I'll go into that on Nigel's post instead of here.

As far as I can tell you didn't. You just repeat *what* you don't
recommend - not *why*. As if spam inspection was some kind of black
magic that only you can master.
And you didn't tell Nigel that the site http://www.thestocktongroup.com/
is alive and kicking (maybe it wasn't yesterday) whether Spamcop
resolves the link or not. Actually it does today - to my surprise.
I thought it might be on a "bulletproof" domain that block DNS queries
from SC. Sometimes I get the feeling that some spamvertized sites are
not online - or even in DNS - until a day or two *after* the spam is
sent. Quite an elabotate scheme to dodge reports.
--
I recommend Macs to my friends, and Windows machines
to those whom I don't mind billing by the hour

[Mike Easter]

Post by Asterix
I didn't say my software prohibits me - it's rather Spamcop's web
form. Eudora lets me forward the spam to a sumbission address without
inspection, but then I completely lose control of where the reports
go. Examining the X-lines is of limited or no interest for that
purpose.

I could use Eudora with SpamPal. SpamPal would identify and tag 'all'
of my spam and tag none of my goodmail. I could use Eudora to the
submit and submit all of my spams at one time I presume. The parser
reporter would provide me with links for each and every spam and then I
could go to the tracker link to oversee and report the spam which I
haven't opened yet.

Then, the parser reporter would show me the headers of the submitted
spam which headers contain my SpamPal's Xlines so that I can see why
each item was spam. Next, SC is going to tell me how it wants to
report. My experience has been that I can recognize an IB in the
deobfuscated links. If I am confused, I can look at the raw spambody
available at the parser.

I could do that, but I don't do it that way for various reasons.

Post by Asterix
I'm more concerned about not reporting "innocent bystander'
- and/or joe-job - web links in the body.

If I were 'inspecting' a spam in the parser view entire spam and I were
confused about IB or j-j and couldn't handle the problem by looking at
the raw body, then I guess I could go to my mailuser agent and render
it, but I would rather not do that. I don't like for the spamitem to
get ahead on my 'scoresheet' -- which scores me higher if I never open
an item I think is a mail which is really a spam, or if I don't have to
open an item to determine it is a spam, or if I don't have to open an
item to report it properly.

For me personally, it is a scorecard. For the various kinds of masses
it is advice to not be opening their spam 'foolishly' or insecurely --
where insecurely means insecure in operating system, mailuser agent, or
browser rendering engine configuration and insecurely also means
insecure in mental condition or pledge commitment. Masses include
unwitting newbies as well as spamcop reporters, see below.

Post by Asterix
And making sure that real spamvertized links get parsed.
How can I do *that* without opening and reading the spam?

I know that when I used to do it, I could do it. Currently I am not
reporting spamvertised links to providers. My 'personal' spam only
contains blackhat/unresponsive spamvertiser providers.

Post by Asterix
Or just use the web form at all without opening the spam?

The webform at the tracker URL gives you total access to the complete
spam. If you can submit it to the submit address without opening it,
you can see the entire raw spam at the tracker.

Post by Asterix
"How do I report spam without opening it - being sure it is really
spam I'm reporting?"

As above.

Post by Asterix
As far as I can tell you didn't. You just repeat *what* you don't
recommend - not *why*. As if spam inspection was some kind of black
magic that only you can master.

Most of what I try to 'advise' or teach about mail/spam handling is what
I recommend to the 'masses' which includes the majority of spamcop
reporters. Some advanced spamfighters do all kinds of things I don't
recommend to the mass of SC reporters, including going to the website
and exploring it.

Post by Asterix
And you didn't tell Nigel that the site
http://www.thestocktongroup.com/ is alive and kicking (maybe it
wasn't yesterday)

Yesterday it didn't resolve, today it is 66.226.64.30 rDNS
pro29.abac.com
Abacus America
NetRange: 66.226.64.0 - 66.226.95.255
OrgAbuseEmail: ***@aplus.net

not currently blocklisted anywhere, including spews or spamhaus, so the
present IP doesn't have a history of unresponsiveness.

Currently SC resolves it quickly.

Post by Asterix
I thought it might be on a "bulletproof" domain that block DNS queries
from SC. Sometimes I get the feeling that some spamvertized sites are
not online - or even in DNS - until a day or two *after* the spam is
sent. Quite an elabotate scheme to dodge reports.

[Asterix]

Post by Mike Easter

Post by Asterix
I didn't say my software prohibits me - it's rather Spamcop's web
form. Eudora lets me forward the spam to a sumbission address without
inspection, but then I completely lose control of where the reports
go. Examining the X-lines is of limited or no interest for that
purpose.

I could use Eudora with SpamPal. SpamPal would identify and tag 'all'
of my spam and tag none of my goodmail. I could use Eudora to the
submit and submit all of my spams at one time I presume. The parser
reporter would provide me with links for each and every spam and then I
could go to the tracker link to oversee and report the spam which I
haven't opened yet.

[and so on]

The procedure you describe just sounds way too tedious, and my guess
is that's why you don't do it yourself any more ... Copy-n-paste -
or even better, drag-n-drop - into the web form is as efficient as this
game ever gets. More work is not worth the effort - to me.

Post by Mike Easter
Most of what I try to 'advise' or teach about mail/spam handling is what
I recommend to the 'masses' which includes the majority of spamcop
reporters. Some advanced spamfighters do all kinds of things I don't
recommend to the mass of SC reporters, including going to the website
and exploring it.

Aah - the "uneducated masses". Heard that one before. The masses
are smarter than you think. But of course there are some morons, too.

Anyway parts of your advice are blunt and miss the target.
- what do you mean by reading spam subjects receptively ?
(English is *not* my mother language)
- I don't read spam bodies for content, but for links and for
appearances of my address in the body. OK - that is contents ? :-)
- Who would get the idea of reading Spammy's mind ?

Unlike them I don't use Windows, so I can open next to anything with
next to zero risk.

Post by Mike Easter

Post by Asterix
And you didn't tell Nigel that the site
http://www.thestocktongroup.com/ is alive and kicking (maybe it
wasn't yesterday)

Yesterday it didn't resolve, today it is 66.226.64.30 rDNS
pro29.abac.com
Abacus America
NetRange: 66.226.64.0 - 66.226.95.255
not currently blocklisted anywhere, including spews or spamhaus, so the
present IP doesn't have a history of unresponsiveness.

So they got a new IP ? - didn't think of that.

[Mike Easter]

Post by Mike Easter
Mike Easter

Post by Mike Easter

Post by Asterix
I didn't say my software prohibits me - it's rather Spamcop's web
form. Eudora lets me forward the spam to a sumbission address
without inspection, but then I completely lose control of where the
reports go. Examining the X-lines is of limited or no interest for
that purpose.

I could use Eudora with SpamPal.

The procedure you describe just sounds way too tedious,

No, we have different 'default' modes. My default mode is to not open
my spam unless I have to. Your default mode is to open your spam, I
think..

My default mode isn't tedious at all, it is quick. I go to my Junk
folder, 'globally view' [overview their subject/froms in a glance seeing
there isn't anything from some forgotten friend in there] on the
spamgroup, gather them en masse and quick report them with a series of
keystrokes which take about 2 seconds and also mark the spams as 'read'.

I quick report because I'm not notifying spamvertiser providers for the
reasons I explained.

If I should need to check the interior of a spam, I am not in default
mode, and the first thing I look at is the headers - first what
SpamPal's Xlines say, and then if I need any additional information I
use my own techniques.

Post by Mike Easter
More work is not worth the effort - to me.

It isn't more work for me.

Post by Mike Easter

Post by Mike Easter
Most of what I try to 'advise' or teach about mail/spam handling is
what I recommend to the 'masses' which includes the majority of
spamcop reporters. Some advanced spamfighters do all kinds of
things I don't recommend to the mass of SC reporters, including
going to the website and exploring it.

Aah - the "uneducated masses".

My term did *not* say uneducated. The masses are a lot of different
things, some are pledged to never aid a spammer, some are not. Some are
insecurely configured, some are not. Some just need some advice about
how to handle their mail, not be a reporter.

Post by Mike Easter
Heard that one before. The masses
are smarter than you think. But of course there are some morons, too.

Of course. Don't ascribe words to me that I didn't say and more
importantly didn't mean.

Post by Mike Easter
Anyway parts of your advice are blunt and miss the target.
- what do you mean by reading spam subjects receptively ?

The recipient is reading the subject to see if she is interested in
reading the spam for content.

Post by Mike Easter
(English is *not* my mother language)

OK. It is practically the only one I have even though I've spent some
years in both Spanish and German language classes and lots of time in
Mexico and Southern California locales in which the first language is
Spanish not English.

Post by Mike Easter
- I don't read spam bodies for content, but for links and for
appearances of my address in the body. OK - that is contents ? :-)

That is 'inspection'. You can inspect the interior of a spam without
even reading it. You can even use a tool to search it for the
occurrence of your username or a derivation thereof.

Post by Mike Easter
- Who would get the idea of reading Spammy's mind ?

Lotsa people make themselves crazy trying to figure out why a spammer
did something.

Post by Mike Easter
Unlike them I don't use Windows, so I can open next to anything with
next to zero risk.

Yes. Not using Win and OE and IE's rendering engine is one element of
security -- or rather one element of not being insecure in that
particular way.

Post by Mike Easter

Post by Mike Easter
not currently blocklisted anywhere, including spews or spamhaus, so
the present IP doesn't have a history of unresponsiveness.

So they got a new IP ? - didn't think of that.

I don't know. It is hard to figure out what an old IP used to be unless
it is somewhere in sightings and resolved differently.

[D.F. Manno]

Post by anon
No, I mean do not open the spam at all (not talking about pictures or
anything else) - just do not open it at all.

That advice is useless if you want to report to Spamcop and you have a email
client that breaks the headers when you forward the spam.

[antioch]

Yes - they are in .gif format and cannot be stopped with message rules
unless you add a rule to stop any mail that does not contain each letter of
the alphabet - long winded I know - I was getting 6 a day - had none for two
days - perhaps they don't work at the weekends.
Others have reported same in the past in spamcop groups.
Rgds
Antioch
PS
To Mike Easter - think I got the hang of the reporting - well not been
black-balled yet!!!!

Post by Søren Jacob Lauritsen
Hello there!
Four times a day since the end of April, I have been blessed with e-mails
containing text as pictures. I'm pretty sure they're from the same source.
They all share the same "look": Text on a colored background (light red or
light green). The contents of the text differs from time to time.
Have anybody received these e-mails? The spammer seems to be unstoppable.
So any suggestions would be nice. It's the first time, I haven't been able
to stop them within a few days.
Best regards,
Søren
--
Remove nospam to write me! :-)

[Mike Easter]

Post by antioch
To Mike Easter - think I got the hang of the reporting - well not been
black-balled yet!!!!

Good.

Now we are going to have to train you to post by trimming and
contextualizing your news messages for much greater clarity.

Here's an example of a guide
http://members.fortunecity.com/nnqweb/nquote.html
news.newusers.questions - Quoting Style in Newsgroup Postings

[antioch]

Post by Mike Easter

Post by antioch
To Mike Easter - think I got the hang of the reporting - well not been
black-balled yet!!!!

Good.
Now we are going to have to train you to post by trimming and
contextualizing your news messages for much greater clarity.

I already do - we call it 'clipping' - some dont like it in msnewsgroups.
I do it all the time - its a personal issue anyhow - like top or bottom
posting.
I guess you do it slightly different here from what I have just read.
When things get long and complicated and you dont bottom post, you get a
smack - certainly if you dont clip/trim parts of the post.
Take care - if others are getting these stock spams, I might get less - no
perhaps not ;-) ;-)
Rgds
Antioch

Post by Mike Easter
Here's an example of a guide
http://members.fortunecity.com/nnqweb/nquote.html
news.newusers.questions - Quoting Style in Newsgroup Postings
--
Mike Easter
kibitzer, not SC admin

[Mike Easter]

"Mike Easter"

Post by Mike Easter
trimming and
contextualizing

I already do - we call it 'clipping' - some dont like it in
msnewsgroups.

I leave the MS MVPs alone about their shabby posting style when I'm
participating in MS public ng/s, but if MVP gurus top post when they are
'outside' in the normal usenet I beat them up about it. Not only do I
beat them up about top posting outside of MS ng/s, but I also beat them
up for 'causing' the MS ng/s to be in such a condition, and for badly
'training' by example or guiding all of the newbies who start usenet
participation in the MS ng/s. The rest of usenet and ng/s are *not*
like the MS groups. Very very few ng/s are like that.

I do it all the time -

I noticed that earlier sometimes you /were/ contextualizing.

its a personal issue anyhow -
like top or bottom posting.

It is a lot more than a 'personal' issue -- there is no such thing being
discussed as 'bottom' posting. Top posting is untrimmed
noncontextualized posting up above everything else with an additional
failure to 'organize' the cite attributions because there is no
meaningful citing and attributing because there is no trimming or
contextualizing.

The opposite of top posting is trimmed and contextualized -- not
untrimmed noncontextualized posting down underneath everything else on
the 'bottom'. An untrimmed and thus non-contextualized bottom post is
its own problem, which problem is often bandied about by top posters who
think it is a top vs bottom issue, like left handed and right handed.

That means that the topposter makes a complete mess of a thread because
of the disruption of the order of the conversation -- and no one else
can fix it without completely disassembling and reconstructing the top
poster's remark; or alternatively aggressively chopping off everything
which had ever preceded the top poster's remark which pushed all that
preceding down below.

I guess you do it slightly different here from what I have just read.
When things get long and complicated and you dont bottom post, you
get a smack - certainly if you dont clip/trim parts of the post.

Trimming is at the top of the list. If the replier starts by trimming,
everything else about the contextualization comes naturally.

[Johnnie]

Post by Søren Jacob Lauritsen
Hello there!
Four times a day since the end of April, I have been blessed with
e-mails containing text as pictures. I'm pretty sure they're from the
same source. They all share the same "look": Text on a colored
background (light red or light green). The contents of the text differs
from time to time.
Have anybody received these e-mails? The spammer seems to be
unstoppable. So any suggestions would be nice. It's the first time, I
haven't been able to stop them within a few days.

Not only have I received them, the people who send them have used two of
my domains as return addresses so I get dozens of bounces a day.

The spammer is unstoppable and untraceable as he/she uses zombies to do
the mailing. I just wish he/she would move on to someone elses' domain!!

It is filterable as both Yahoo and Broghtmail put the emails in the spam
folder and about 60% of the bounces too.

Filtering them is easy as you can just filter out anything that is all
or almost all picture and is not from anyone in your address book.