Before you play with the settings, consider updating to the current version of SpamAssassin. You're probably using 2.44; the current version is 2.61. At this point, that much spam getting through would be expected behavior.
-tom > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of Barry Callahan > Sent: Sunday, December 21, 2003 4:05 PM > To: [EMAIL PROTECTED] > Subject: [SAtalk] Image-only spam > > I installed Spamassassin from a RedHat RPM as a test a day or > two ago, and it's properly flagging about 1/3 of the incoming > SPAM as such. I have not played around with any of the settings yet. > > Half of what's getting through has a score of 3.6 - 4.0. > This is not the group that overly concerns me, as I'm sure I > can adjust things to get these properly detected. > > The other half of what's getting through, I'm not so sure > about. It has a score of -1.1 - +1.1. Yes, I'm getting SPAM > with a negative SPAM score. > > In all cases, the messages in the last group have the > following in common: > > 1) They're Multipart Mime-formatted messages. > 2) A text/plain section exists, but contains only blank lines. > 3) The text/html section contains two or more HTML comments > containing random alphanumeric strings. > 4) The text/html section contains one or more image tags > which reference images on some random webserver. > 5) At least one of the images is a link. > 6) The text/html section contains absolutely no displayable text. > > So, an example of what the text/html section might contain is: > > <html><body> > <center><!--l25cxq1atrz--><a href="REMOVED"><!--srQ3lVIGl6vp--><img > src="REMOVED" border=0></a></center> > </html></body> > > Is anyone else seeing SPAM like this? > Would anyone be able to make suggestions on how to go about > writing a ruleset to tag these? > > Thanks. > > Barry > > > > > ------------------------------------------------------- > This SF.net email is sponsored by: IBM Linux Tutorials. > Become an expert in LINUX or just sharpen your skills. Sign > up for IBM's Free Linux Tutorials. Learn everything from the > bash shell to sys admin. > Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click > _______________________________________________ > Spamassassin-talk mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/spamassassin-talk > > ------------------------------------------------------- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id78&alloc_id371&op=click _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
