Tiny image only spam [OT]

[Gary Faith]

I have seen this too.  I ran across several sites that pointed me to
some software that has solved this problem.  I looked at this first:
 
http://www.nabble.com/GIF-Spam----Setting-up-the-%27OCR-scanner-and-image-validator-SA-plugin%27-to5622534.html
 
But this is the one that I adapted from MaiaMailGuard to MailScanner.
 
http://www.maiamailguard.com/files/SLES10_MaiaMailGuard_Gateway_102.pdf
 
Basically, I installed 
 
-rw-r--r-- 1 root root  124418 Jan  7  2007
fuzzyocr-3.5.1-devel.tar.gz
-rw-r--r-- 1 root root  248889 Apr  4 01:15 gifsicle-1.55.tar.gz
-rw-r--r-- 1 root root  700288 Oct 22  2008 gocr-0.46.tar.gz
-rw-r--r-- 1 root root  363267 Mar 29 16:54 gocr-0.47.tar.gz
-rw-r--r-- 1 root root   95139 May  5 16:06 ocrad-0.18-rc1.tar.gz
-rw-r--r-- 1 root root   37544 May  5 16:26 sample-mails.tar.gz
 
and I needed to install:  giflib-progs-4.1.4-14.2 needed by gif
conversion programs and I needed to install several perl modules.
 
BTW, gocr-0.47 has a build problem with linker flags not being
specified but I was able to work around it eventually.
 
I only implemented it earlier last week, and so far stopped 502 e-mails
with image based spam:
 
FUZZY_OCR Mail contains an image with common spam text inside 502 0 0
502 100
 
Gary Faith

>>> Alessandro Bianchi <alex at skynet-srl.com> 5/10/2009 12:37 PM >>>
In the last days I'm getting a lot of image only spam.

It contains no links and no text at all

The size of the image is different every time, and it advertizes
pharmacy inviting users to visit funny sites with always different names
like www.8654.org and similar.

I've palayed around spamassassin rules with some luck (somettimes I
catch sometimes I don't).

Has anyone else seen something similar?

Any ideas about how to stop it?

Best regards and thanks

Alessandro Bianchi

-- 

SkyNet SRL
P.zza XXV Aprile 14 - 28021 Borgomanero (NO) - ITALY
Tel. +39 0322 836487/834765 - Fax.+39 0322.836608
info at skynet-srl.com -www.skynet-srl.com






Le informazioni contenute in questo messaggio sono riservate e
confidenziali e ne é vietata la diffusione in qualunque forma.
Qualora Lei non fosse la persona a cui il presente messaggio é
destinato, La invitiamo ad eliminarlo dandocene gentilmente
comunicazione.
Per qualsiasi informazione in merito si prega di contattare
info at skynet-srl.com. ( Rif. D.L. 196/200 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090510/2ba8d36b/attachment.html