Tiled gif spam

[Martin.Hepworth]

Better would be to post the entire spam email (headers and all) somewhere then we can run through our systems and see what hits.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

> -----Original Message-----
> From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-
> bounces at lists.mailscanner.info] On Behalf Of Gareth
> Sent: 23 August 2007 16:25
> To: MailScanner discussion
> Subject: Re: Tiled gif spam
>
> On Thu, 2007-08-23 at 15:51, Denis Beauchemin wrote:
> > Glenn Steen a écrit :
> > > On 23/08/07, Andrew MacLachlan <andy.mac at global-domination.org> wrote:
> > >
> > >> Sorry - this is the analysis from Mailwatch:
> > >>
> > >> Spam Report:
> > >> Score   Matching Rule
> > >>         score=3.919
> > >> 4       required
> > >> 0.00    DKIM_SIGNED
> > >> -0.00   DKIM_VERIFIED
> > >> 2.50    HTML_IMAGE_ONLY_16
> > >> 0.00    HTML_MESSAGE
> > >> 1.42    SARE_GIF_ATTACH
> > >>
> > >> As you can see, it was almost trapped. Of course I could always up
> the
> > >> scores for SARE_GIF_ATTACH and HTML_IMAGE_ONLY_16, but I think an
> > >> additional rule for side-by-side gifs might be a better approach? I'm
> > >> not sure what the best score might be for such a rule - but something
> > >> around the 1.0 mark would probably be appropriate.
> > >>
> > >> -Andy
> > >>
> > >>
> > > Why don't you use ImageInfo? Or do you do that and it didn't trigger
> > > even one little rule? If so... Strange...
> > >
> > > Cheers
> > >
> > Glenn,
> >
> > Just installed it and fed it the email and... nothing...  I ran SA in
> > debug and saw it there, but no scoring...
> >
> > How can I tell it to look for n side-by-side gifs?  I didn't see
> > anything about side-by-side images, just the total amount of images,
> > which could trigger on many FP...
> >
> > Thanks!
> >
> > Denis
>
> Can you post the image up somewhere then we can take a look.
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!




**********************************************************************
Confidentiality : This e-mail and any attachments are intended for the 
addressee only and may be confidential. If they come to you in error 
you must take no action based on them, nor must you copy or show them 
to anyone. Please advise the sender by replying to this e-mail 
immediately and then delete the original from your computer.
Opinion : Any opinions expressed in this e-mail are entirely those of 
the author and unless specifically stated to the contrary, are not 
necessarily those of the author's employer.
Security Warning : Internet e-mail is not necessarily a secure 
communications medium and can be subject to data corruption. We advise 
that you consider this fact when e-mailing us. 
Viruses : We have taken steps to ensure that this e-mail and any 
attachments are free from known viruses but in keeping with good 
computing practice, you should ensure that they are virus free.

Red Lion 49 Ltd T/A Solid State Logic
Registered as a limited company in England and Wales 
(Company No:5362730)
Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU, 
United Kingdom
**********************************************************************