Thanks Bill. I have been using the SARE stock rules but the others I was
unaware of - as well as the update script!
-Nick
Bill Landry wrote:
You might also want to look at using the SARE rules at
http://www.rulesemporium.com/rules.htm, particularly the SARE Stock
rules (70_sare_stocks.cf). Also, a couple of Fred's rule sets at
http://www.rulesemporium.com/other-rules.htm (88_FVGT_rawbody.cf &
99_FVGT_meta.cf) can be quite helpful, as well.
If you are running SA 3.1.1, you can also use the sa-update script to
pull down the latest SA rules, which includes additional rules found
in the 80_additional.cf rule set that are very good at tagging these
kinds of image spams.
And finally, Sniffer seems to successfully tag almost 100% of these
image spams, and Razor tags a majority of them, as well.
Bill
----- Original Message ----- From: "Nick Hayer" <[EMAIL PROTECTED]>
To: <Declude.JunkMail@declude.com>
Sent: Thursday, May 04, 2006 7:39 AM
Subject: [Declude.JunkMail] image spam
fyi -
I just found these 2 plugins for spamassassin
http://wiki.apache.org/spamassassin/OcrPlugin
http://antispam.imp.ch/patches/patch-ocrtext
That will ocr the gifs, etc. These should help SA be even more
effective within Declude..
-Nick
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
