Which Rule - Follow Up

[Clay Davis <cd...@avionics-specialties.com>]

At the moment, I am looking for a rule to score this type of spam.  As I
understand it... which is limited... the Bayes check has minimal success
on this... true?
Thanks,
Clay

Re: Which Rule - Follow Up

[Matt Kettler <mk...@verizon.net>]

Clay Davis wrote:
> At the moment, I am looking for a rule to score this type of spam.  As
> I understand it... which is limited... the Bayes check has minimal
> success on this... true?
> Thanks,
> Clay

This is what's known as an "image spam". And you're right, bayes has
minimal success against them. However, it is still worth training some
to make sure bayes doesn't wind up causing problems (ie BAYES_00), but
it's tough to reliably get them to match anything over BAYES_50.

Your best bets here are:

1) make sure you're using RBLs.. a vast majority of these come from XBL
listed hosts. If you are comfortable with it, consider using XBL as a
blacklist at the MTA layer. It's FP rate is impressively low.

2) Consider adding the ImageInfo or FuzzyOCR plugins. FuzzyOCR is a bit
more CPU intensive, but also extracts the text from the images so is
very specific. ImageInfo is lighter weight, and examines the image
attributes.

3) Consider adding the SARE "stocks" ruleset from rulesemporium.com.
This contains a few rules dedicated to these.