How SpamButcher Blocks PDF Spam (and you can too!)

SpamButcher doesn't block all PDF based spam - but we're getting a lot better at handling it.

If it was acceptable to simply delete any message containing a PDF - that would certainly end the problem. The gotcha is that a lot of businesses use PDF files for invoices and other official documents.

However, many users don't frequently exchange PDF files and may be happy just deleting any message with a PDF attached. If that sounds like you, read on.

Normally we don't divulge specifics on how SpamButcher goes about blocking spam to help keep the competition and spammers in the dark. In this case, there's some info I can share that might help users without giving away too much to the enemy.

There are also a few things we detect that would be easy for spammers to change and circumvent. We're going to keep those secret.

Detecting the PDF

I've found the most reliable way to detect an attached PDF is to scan the message for the actual heading of the PDF file.

All PDF files start with: %PDF-1.

When encoded as an attachment it appears like this: JVBERi0xLj

If you want to have your email client automatically delete or move PDF files, define a rule containing the above string.

If you're using a spam killer, you can define the custom filtering rule inside of it if you prefer.

PDF files are normally large

So, PDF files attached to spam messages are abnormally small - commonly under 45k. When SpamButcher sees an email containing a small PDF file, there's a good chance it will get deleted.

Back