On Wed, 2009-06-17 at 13:33 +0200, Paweł Tęcza wrote: > Ibrahim Harrani pisze: > > Hi, > > > > another header from another image spams. > > All images contain god, bad and a url with numbers. > > The spamers are cunning... It seems that they have stopped sending spams > with X-Mailer: header containing something like "PHP v5.2.0" or > "PHP/4.4.5". Also they don't use only digits in attachment filenames. > So I'm affraid that my Spamassassin rules are not effective for that > kind of spam :( > > > It seems that ocrad can't decode the strings in the images. > > FuzzyOcr version is 3.6.0 > > I've added "BAD", "GOOD" and exemplary domain name to my FuzzyOcr word > file, but unfortunately FuzzyOcr didn't recognise them :( > > Maybe someone has better idea how to fight that image spam? > > Cheers, > > P. > But this is all totally academic; Why jump through all the hoops to block the image when the original connecting IP is showing 'unknown' in the hostname
Received: from unknown (HELO ognh.user.ono.com) Is listed on piles of policy and RBL lists; 62.57.252.74 listed in b.barracudacentral.org. 62.57.252.74 listed in PBL (SPAMHAUS) 62.57.252.74 listed in XBL NJABL 62.57.252.74 listed in dul.dnsbl.sorbs.net 62.57.252.74 listed in cbl.abuseat.org. 62.57.252.74 listed in bl.spamcop.net. 62.57.252.74 listed in no-more-funn.moensted.dk. and has SEX twice in the subject. Why would it ever get as far as blocking it on the content? What has gone so wrong it ever got that far?
