Help

[san <sa...@gmail.com>]

Hello..

I have received lots of spam mails like the one i have attached...


So I would like to make a rule to detect this kind of spam 
I have gone through SARE and i did't get any rule to aviod this and iam ver
new to spam assassin

Anyone who can make this rule?
Any kind of help is much appreciated


Thanks...
http://www.nabble.com/file/3930/acce.htm acce.htm 
-- 
View this message in context: http://www.nabble.com/Help-tf2547637.html#a7100155
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: Help

[Matt Kettler <mk...@verizon.net>]

san wrote:
> Hello..
>
> I have received lots of spam mails like the one i have attached...
>
>
> So I would like to make a rule to detect this kind of spam 
> I have gone through SARE and i did't get any rule to aviod this and iam ver
> new to spam assassin
>
> Anyone who can make this rule?
> Any kind of help is much appreciated
>
>
> Thanks...
> http://www.nabble.com/file/3930/acce.htm acce.htm 
>   
That looks like just a text-only capture, so we're only seeing part of
the message, not the actual message.

I'm making a guess, but does the spam in question have an image (.gif
file) attached that contains the advertisement?

If so, the SARE stocks ruleset is your best bet.

Make sure your SA is set up to use DNSBLs, as most of these "image
spams" are sent from hosts listed in XBL. To do this, make sure you have
the Net::DNS perl module installed, and make sure you're not using the
-L parameter to spamassassin/spamc.

Aggressive bayes training with sa-learn helps some, but it's not highly
effective against this wave. It does help keep them in the "BAYES_50"
zone, instead of lower, but that's not going to catch the spam by itself.

Others have been using the FuzzyOCR plugin, but this is a bit expensive
in terms of CPU load. It also seems some of the more recent ones are
adapting by using cluttered backgrounds.