I've seen a big increase in the amount of image spam, I spoke with Ironport support and they had me use the following filter:stock_spam:if ((recv-listener == "IncomingMail") AND (body-size < 63488) AND(attachment-filetype == "gif") AND (attachment-si...