Tiled gif spam

[Andrew MacLachlan]

New install - Bayes DB not yet populated :-(

> -----Original Message-----
> From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-
> bounces at lists.mailscanner.info] On Behalf Of Gareth
> Sent: 23 August 2007 14:25
> To: MailScanner discussion
> Subject: RE: Tiled gif spam
> 
> No Bayes?
> 
> On Thu, 2007-08-23 at 14:21, Andrew MacLachlan wrote:
> > Sorry - this is the analysis from Mailwatch:
> >
> > Spam Report:
> > Score	Matching Rule
> > 	score=3.919
> > 4	required
> > 0.00	DKIM_SIGNED
> > -0.00	DKIM_VERIFIED
> > 2.50	HTML_IMAGE_ONLY_16
> > 0.00	HTML_MESSAGE
> > 1.42	SARE_GIF_ATTACH
> >
> > As you can see, it was almost trapped. Of course I could always up
the
> > scores for SARE_GIF_ATTACH and HTML_IMAGE_ONLY_16, but I think an
> > additional rule for side-by-side gifs might be a better approach?
I'm
> > not sure what the best score might be for such a rule - but
something
> > around the 1.0 mark would probably be appropriate.
> >
> > -Andy
> >
> > > -----Original Message-----
> > > From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-
> > > bounces at lists.mailscanner.info] On Behalf Of Andrew MacLachlan
> > > Sent: 23 August 2007 14:03
> > > To: MailScanner discussion
> > > Subject: Tiled gif spam
> > >
> > > I just forwarded this from my Yahoo acct through my MailScanner
with
> > > FuzzyOcr and it sailed straight through... I'm not sure what my
MTA
> > > level checks would have made of the original message though.
> > >
> > > Does anyone have any special tricks or rules to combat these
messages?
> > >
> > > I'm running the latest everything on Centos 4.5
> > >
> > > -Andy
> > >
> > >
> > > --
> > > This message was scanned by ESVA and is believed to be clean.
> > >
> >
> >
> >
> > --
> > This message was scanned by ESVA and is believed to be clean.
> 
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website!
> 
> --
> This message was scanned by ESVA and is believed to be clean.
> Click here to report this message as spam.
> http://mail-gw.global-domination.org/cgi-bin/learn-
> msg.cgi?id=188D017002.BFCDE
> 
> 



--
This message was scanned by ESVA and is believed to be clean.