I'm having similar results here. As others have mentioned, the SARE stock rules do help somewhat, but it's by no means the proverbial "silver bullet". As someone else also mentioned, it helps to increase the HTML_IMAGE_ONLY_XX rules. I increased 12,16,20, and 24 by one point each. However, that still doesn't nail all of them. I have seen some come through without even hitting any HTML_IMAGE_ONLY_XX rules.
It seems to me that with these image-only spams, spammers may have finally stumbled onto a pretty good weapon to counter SA, and to defeat Bayes. With broadband connections being dirt cheap these days, and with all the zombie nets at their disposal, spammers can now blast out large spams in a short amount of time, without causing much drain on their own network resources. I'm getting image-only spam with attachments ranging in size from about 12K to 70K. I'll bet it's only a matter of time before we start seeing spam larger than 256K, which I believe is the threshold that most people use to determine whether to send a message to SA for scanning or not. We'll probably all be bumping up that threshold at some point. :( Craig Quoting Jack Gostl <[EMAIL PROTECTED]>: > I've seen some references to this in threads, but I didn't see an answer. > > Starting in late November, we started getting hit with spam that was almost > entirely a jpeg. They seem to be mostly "stock recommendations". There is > minimal message, usually HTML, and the real spam content is in the image. > Despite al the trainging that I do, this seems to slip through the Bayes > algorithms with no more than a 50%, and the rest of the tests don't drive the > score up high enough to help. > > I am currently running SpamAssassin 3.0.3. I tried running these messages > through SpamAssassin 3.1 and it doesn't seem to help. > > Any suggestions? > > Thanks - Jack >
