RE: [Declude.JunkMail] picture spam

[Craig Edmonds]

It good to see that other methods work too.   Unfortunately I myself dont have too much time to fiddle with filters so I rely on sniffer, commtouch, declude, invurbl, clam, norton to catch all the muck and do it all for me.   One thing I will say though, on one server, I disabled Sniffer the other day and forgot to turn it back on, so for a few days I was receiving image spam and could not figure it out until I realised it was disabled. (I have commtouch on the same server btw).   As soon as I turned sniffer back on, no more image spams.   hmmmmm. (I dont think commtouch is "that" infalible but it does filter quite alot though)   I still get a few spam emails through every day despite having alot of checks but then again my email has been around a few years but many of my clients have noticeed a huge reduction in spam since implementing spam checking early last year and the way they thank me is by renewing their services promptly.   Kindest Regards Craig Edmonds 123 Marbella Internet W: www.123marbella.com From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Thursday, October 12, 2006 4:44 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] picture spam We don't use Commtouch, and do not intend to license it.  However, we do not have trouble with image spam leaking through our system (still on Declude 1.82, though we do have a valid license and SA for 4.x).  Across all hosted domains we get on average two or three leakage reports a week.  On our own domains, we see one or two spam messages get through per week on average.  So, I'd say our "fidd[ing] with filters, weights, and false positives" is working pretty well.   Also, I've seen statistics posted that indicate Commtouch is not as good as Sniffer at the overall catch rate.  As for the statistics you mention, note that one email account or one domain is a very poor indicator for performance on a larger cross section of domains and users.  Small sample populations have large error bars.   My initial response was simply to comment on the danger of using the filter.  When posting such, it's important to indicate exactly what it catches and the danger of using it.  Many might have read the posting and thought it would catch image spam, when it really catches attached or embedded images, potentially leading to a high number of false positives.  While this is useful in a combo test, it should not be given any weight individually.  While you do mention keeping the weight low, bear in mind that many of us have scaled our weighting system differently that the default for more granularity.  Personally, I prefer to hold at 100 and scale all tests as a percentage of the hold weight.   Darin.     ----- Original Message ----- From: chris To: declude.junkmail@declude.com Sent: Thursday, October 12, 2006 10:08 AM Subject: RE: [Declude.JunkMail] picture spam No, I am making the assumption you will not have to deal with anymore picture spam if you use Commtouch…You can fiddle with filters, weights and false positives if you’d like.  I have been an advocate of Commtouch since we starting using it, matter of fact I have yet to get two pieces of spam since we started using the Gateway w/Commtouch combo.  In four months I have seen just one false positive.  Just my observation though!!   Chris           From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Thursday, October 12, 2006 9:39 AM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] picture spam   You're making an assumption that everyone uses Commtouch. Darin.     ----- Original Message ----- From: chris To: declude.junkmail@declude.com Sent: Thursday, October 12, 2006 9:15 AM Subject: RE: [Declude.JunkMail] picture spam   Guys, Commtouch hasn’t missed any, stop making things hard on yourselves…..     Chris           From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Wednesday, October 11, 2006 5:17 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] picture spam   Sorbs-DUL and NJABL Dynablock look to be the best. Although they miss lots.   5-10's has been discontinued.   ----- Original Message ----- From: Dave Marchette To: declude.junkmail@declude.com Sent: Wednesday, October 11, 2006 3:53 PM Subject: RE: [Declude.JunkMail] picture spam   Thanks all for the various suggestions.  Agreed- combo is the way to use that test, for sure.  A bit OT, but what is the popular and accurate DUL database these days?  How accurate is fiveten at DUL lookups?            From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Wednesday, October 11, 2006 12:49 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] picture spam   I combo the graphics hit (jpg, gif or png) with:   1.  bad DNS - None or timeout   2.  bad language (eastern European iso-8859-2) or Cyrillic (koi8-r or iso-8859-5), etc   3.  cmdspace   4.  good DUL IP lists/tests   5.  having forged your local domain.   I still get 5-10 a day. It is a pain.     ----- Original Message ----- From: Dave Marchette To: declude.junkmail@declude.com Sent: Wednesday, October 11, 2006 12:08 PM Subject: [Declude.JunkMail] picture spam   Has anyone figured out a reasonable way to use Declude to minimize picture spam?  Sniffer is missing most.  They are sent from fresh hosts, so RBL’s don’t catch them, and there is no target, so INVuribl misses them as well.   Associates of ours are using Barracuda to stop most successfully, so it is at least possible.   Ideas are welcomed.   Dave           --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.