Graphic Based Spams

[Martin Hepworth]

Michael

NB major scores where from the two RBL's !!

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Michael Baird wrote:
> Ok, great, sounds like upgrading to the latest spamassassin is going to
> help.
>
> Regards
> Michael Baird
>
>
>>Michael
>>
>>ok here's what I got..
>>
>>tests=FR_HEAD_EMPTY,HTML_20_30,
>>         HTML_FONT_INVISIBLE,HTML_IMAGE_ONLY_24,HTML_MESSAGE,
>>         RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_XBL,SARE_HTML_HEAD_EMPTY
>>
>>score of 8.6, which in my case would tag the subject the deliver (scores
>>over 10 don't get delivered).
>>
>>AS I thought the URI-RBL's didn;t trigger as the email has all the
>>images etc inline. BUT the XBL and spamcop RBL's did fire (the only two
>>RBL's I use). Also the HTML rules fired some rules inbuilt into sa 3
>>(HTML_*)and some from www.rulesemporium.com (SARE_* and FR_*).
>>
>>So it maybe worth you while upgrading to SA 3.02...as well as putting in
>>Fred's rules and the SARE rules from www.rulesemporium.com/rules.htm
>>
>>--
>>Martin Hepworth
>>Snr Systems Administrator
>>Solid State Logic
>>Tel: +44 (0)1865 842300
>>
>>
>>Michael Baird wrote:
>>
>>>Thanks Martin, I've put an example up at
>>>http://linux.tc3net.com/drwho/viagraspam.tar.gz, if you want to run it
>>>through SA 3.02
>>>
>>>Regards
>>>Michael Baird
>>>
>>>
>>>
>>>>Michael
>>>>
>>>>if you can drop the email somewhere I can pick it up (ftp or http site
>>>>and save the email as a .txt with ALL the header info), I can run it on
>>>>my 3.02 system which also has lots of the SARE and other rules as extras.
>>>>
>>>>If the html has the pictures embedded within the message (rather than a
>>>>call to a URL to get them) then the URL-RBL (spamcop plugin for subl.org
>>>>URI-RBL's) won't help much.
>>>>
>>>>Anyway if you can let me have the mesg I can advise better,
>>>>
>>>>--
>>>>Martin Hepworth
>>>>Snr Systems Administrator
>>>>Solid State Logic
>>>>Tel: +44 (0)1865 842300
>>>>
>>>>
>>>>Michael Baird wrote:
>>>>
>>>>
>>>>>Heh guys, this may not be a problem directly related to MailScanner, but
>>>>>I'm having issues with spams that are just graphics (Viagra Cheap), they
>>>>>score very low and make it through. What is the best way to handle these
>>>>>types of spam, tweak the spamassassin scores a bit? Update to the latest
>>>>>spamassassin? Just looking for advice on the subject.
>>>>>
>>>>>Regards
>>>>>Michael Baird
>>>>>
>>>>>------------------------ MailScanner list ------------------------
>>>>>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>>>>'leave mailscanner' in the body of the email.
>>>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>>>
>>>>>Support MailScanner development - buy the book off the website!
>>>>
>>>>**********************************************************************
>>>>
>>>>This email and any files transmitted with it are confidential and
>>>>intended solely for the use of the individual or entity to whom they
>>>>are addressed. If you have received this email in error please notify
>>>>the system manager.
>>>>
>>>>This footnote confirms that this email message has been swept
>>>>for the presence of computer viruses and is believed to be clean.
>>>>
>>>>**********************************************************************
>>>>
>>>>------------------------ MailScanner list ------------------------
>>>>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>>>'leave mailscanner' in the body of the email.
>>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>>
>>>>Support MailScanner development - buy the book off the website!
>>>
>>>
>>>------------------------ MailScanner list ------------------------
>>>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>>'leave mailscanner' in the body of the email.
>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>>Support MailScanner development - buy the book off the website!
>>
>>**********************************************************************
>>
>>This email and any files transmitted with it are confidential and
>>intended solely for the use of the individual or entity to whom they
>>are addressed. If you have received this email in error please notify
>>the system manager.
>>
>>This footnote confirms that this email message has been swept
>>for the presence of computer viruses and is believed to be clean.
>>
>>**********************************************************************
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!