Why doesn't DCC help against image spam?

[Martin.Hepworth]

Dennis

You'll probably find the SARE rules (esp SARE_Stocks) and Fred's Rules
from www.rulesemporium.com are very effective again these stock spams.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

> -----Original Message-----
> From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-
> bounces at lists.mailscanner.info] On Behalf Of Dennis Willson
> Sent: 27 December 2006 17:52
> To: MailScanner discussion
> Subject: Re: Why doesn't DCC help against image spam?
>
>
> The only "image" Spam that is currently getting through my filters is
> the "stock scam" images and they are different everytime I see it and
> they are using wavy text, odd colors and mixed fonts, etc... to try
> and fool the OCR scanners.
>
> So, my question would be, how effective are the OCR scanners when the
> Spammers are doing this?
>
> Since I put my new Spam Trap in place I have seen a reduction of this
> Spam getting through. It appears the honeypots are seeing the sources
> of the images first (or close to it) and stopping that source...
> ofcourse they rotate sources through out the day, but the honeypots
> are getting over 2000-3000 new IP address every day. The "hit rate" on
> the now blacklisted source is fairly high.
>
>
>
> On Wed, 27 Dec 2006 11:21:47 -0500
>   Matt Kettler <mkettler at evi-inc.com> wrote:
> >Pete Russell wrote:
> >>
> >>
> >> Glenn Steen wrote:
> >>>>
> >>>> FuzzyOCR runs by default with a low priority (runs as last SA
test),
> >>>>so
> >>>> it only run when the SA score (so far) is > $X, so set that to
your
> >>>>low
> >>>> threshold, and FuzzyOCR only runs on spam that hasn't been tagged
> >>>>yet.
> >>>> Works quite well, and doesn't take all that much cpu, since > 70%
of
> >>>>the
> >>>> image spam is caught by the other methods.
> >>> True enough... When I've been testing I haven't been taking that
> >>>into
> >>> consideration (looking at "synthetic" situations can blind one to
> >>> things:-). Will likely implement it in production some time early
> >>>next
> >>> year then. Thanks Ken.
> >>
> >> Should one use imageinfo OR FuzzyOCR, or both together?
> >
> >If you have plenty of CPU cycles to spare, go for both.
> >
> >imageinfo is pretty lightweight, so anyone should be able to use it
> >unless their
> >SA box is already overloaded.
> >
> >FuzzyOCR isn't too bad because of the priority thing, but it is still
> >a
> >noticeable load. Folks with servers that are already getting to be a
> >little bit
> >marginal should skip this.
> >
> >--
> >MailScanner mailing list
> >mailscanner at lists.mailscanner.info
> >http://lists.mailscanner.info/mailman/listinfo/mailscanner
> >
> >Before posting, read http://wiki.mailscanner.info/posting
> >
> >Support MailScanner development - buy the book off the website!
>
>
> --------------------------------------------------
> Dennis Willson
>
> taz at taz-mania.com
> http://www.taz-mania.com
>
> Ham (Extra Class): ka6lsw
> Scuba: Rescue Diver, EANx, Wreck, Night, Alt, Equip, UW Photographer,
> Gas Blender
>
> Owner: Kepnet Internet Services
>
> Life should not be a journey to the grave with the intention of
> arriving safely in a nice looking and well preserved body, but rather
> to skid in broadside, thoroughly used up, totally worn out, and loudly
> proclaiming, "WOW! WHAT A RIDE!"
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!




**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.	

**********************************************************************