Image spam and Bayes problem

["Gary W. Smith" <ga...@primeexalia.com>]

I haven't been watching the list much lately so I apologize if this
topic has been kicked to death.  

I've seen a sharp increase in our OB Ticker spam's that consist of an
image and some text.  It passed the greylist just fine and was labeled
as bayes_00.

X-Spam-Status: No, score=-7.5 required=5.0
tests=BAYES_00,EXTRA_MPART_TYPE,
	HTML_30_40,HTML_IMAGE_ONLY_28,HTML_MESSAGE autolearn=no
version=3.1.7

The image contained the OB stock ticker and the text was random, but
coherent sentences.  What's the best course of action to block these
now.  I'm running a couple rules from SARE.  Are there some specific
ones that will help on this?

We were running RBL's at the postfix level but recently we have started
seeing FP's on a couple of them so we disabled them for now (thus
increasing flow from about 200k messages per server per day to about
300k+).

Gary Wayne Smith

Re: Image spam and Bayes problem

[Henrik Krohns <he...@stream.hege.li>]

On Wed, Dec 13, 2006 at 08:55:26PM -0800, Gary W. Smith wrote:
>
> We were running RBL's at the postfix level but recently we have started
> seeing FP's on a couple of them so we disabled them for now (thus
> increasing flow from about 200k messages per server per day to about
> 300k+).

Use policyd-weight instead.

Re: Image spam and Bayes problem

[René Berber <r....@computer.org>]

Gary W. Smith wrote:

> I’ve seen a sharp increase in our OB Ticker spam’s that consist of an
> image and some text.  It passed the greylist just fine and was labeled
> as bayes_00.
> 
> X-Spam-Status: No, score=-7.5 required=5.0 tests=BAYES_00,EXTRA_MPART_TYPE,
> 
>         HTML_30_40,HTML_IMAGE_ONLY_28,HTML_MESSAGE autolearn=no
> version=3.1.7
> 
> The image contained the OB stock ticker and the text was random, but
> coherent sentences.  What’s the best course of action to block these
> now.  I’m running a couple rules from SARE.  Are there some specific
> ones that will help on this?
> 
> We were running RBL’s at the postfix level but recently we have started
> seeing FP’s on a couple of them so we disabled them for now (thus
> increasing flow from about 200k messages per server per day to about 300k+).

Sare_stocks is effective, and for more difficult messages FuzzyOcr which is a
plugin and needs some configuration to get it working.
-- 
René Berber

RE: Image spam and Bayes problem

["Gary W. Smith" <ga...@primeexalia.com>]

Updating the sa rules seemed to make an immediate noticeable difference.
Thanks.

> -----Original Message-----
> From: Theo Van Dinter [mailto:felicity@apache.org]
> Sent: Wednesday, December 13, 2006 9:03 PM
> To: users@spamassassin.apache.org
> Subject: Re: Image spam and Bayes problem
> 
> On Wed, Dec 13, 2006 at 08:55:26PM -0800, Gary W. Smith wrote:
> > The image contained the OB stock ticker and the text was random, but
> > coherent sentences.  What's the best course of action to block these
> > now.  I'm running a couple rules from SARE.  Are there some specific
> > ones that will help on this?
> 
> Use sa-update.
> 
> --
> Randomly Selected Tagline:
> If I were truly original, I'd think of something cute.

Re: Image spam and Bayes problem

[Theo Van Dinter <fe...@apache.org>]

On Wed, Dec 13, 2006 at 08:55:26PM -0800, Gary W. Smith wrote:
> The image contained the OB stock ticker and the text was random, but
> coherent sentences.  What's the best course of action to block these
> now.  I'm running a couple rules from SARE.  Are there some specific
> ones that will help on this?

Use sa-update.

-- 
Randomly Selected Tagline:
If I were truly original, I'd think of something cute.