Increase in image spam from .info past few weeks

[doug.dockter]

Over the past several weeks I've been seeing a significant increase in the amount of image spam that is passing through my C150.  Most of the messages are coming from .info domains.  Outlook funnels most of them to the Junk E-mail folder.  The C150 is not classifying them as spam.

[Jeronimo Orona · Accepted solution]

Hello Doug,

Most image spam is a bit larger in size and some of them may be exceeding your current Messaging Scanning Thresholds for IronPort Anti-Spam(IronPort GUI: Security Services tab>IronPort Anti-Spam>global settings).  If you track some of these messages in the IronPort mail_logs or Message Tracking page, you may find that they were skipped by Anti-Spam scanning, due to exceeding these thresholds. If this is the case, you may be able to resolve the issue by increasing these threshold values.

In preparation for increasing threshold values, you may consider reviewing the following Knowledge Base article.

http://tinyurl.com/33hhr5s

Regards,

-Jerry

[doug.dockter]

Thanks for the helpful post Jerry.  You were correct in that the messages were exceeding the message scanning threshold.  Thanks for the link to the KB.  I've increased the value from 128k to 256k.  If that doesn't have much impact, I'll go to 512k.  My C150 is barely idling so should be able to take the performance hit without too much problem.

[exMSW4319]

What type of image attachment are the spammers using?

How large are the mails on average?

Curious minds want to know...

[doug.dockter]

They are all jpg.  Just checked some from yesterday and they range in size up to 388k.