Well... we have been lucky... what does the body of the email look like? Darin.
----- Original Message ----- From: "Martin Schaible" <[EMAIL PROTECTED]> To: "Darin Cox" <[email protected]> Sent: Monday, November 07, 2005 12:25 PM Subject: Re: [IMail Forum] Image-only Spam-Mails Hi Darin, > How about the URL of the image? Either that or the URL that links the image > to a website is the way most of this is caught. Nope, no URL. Image only. > If there's no link at all (I haven't seen any like that), then it could Good for you ;-) We had hunderts of it today. i attached the image as a sample. > still be filtered by comparing the bit signature of the image with known > spam. Good idea. Maybe i can take some of the binary stuff from the image as a phrase and add it to rules.ima. The regular phrase filter does not work "inside" of images. ============================================ Am Montag, 7. November 2005 um 16:32 schrieben Sie: > How about the URL of the image? Either that or the URL that links the image > to a website is the way most of this is caught. > If there's no link at all (I haven't seen any like that), then it could > still be filtered by comparing the bit signature of the image with known > spam. > Darin. > ----- Original Message ----- > From: "Martin Schaible" <[EMAIL PROTECTED]> > To: "Duane Hill" <[email protected]> > Sent: Monday, November 07, 2005 10:11 AM > Subject: Re: [IMail Forum] Image-only Spam-Mails > Hi, > The problem is, that mostly no url is available. The url is written in to > the image (stupid, isn't it), meaning the recipient has to type the address. > Other mails are advertising stock recommondations, no url.... > This is my problem, the only chance is to hope, that an external service is > able to catch such ad's. If not, the mail will pass through. > ============================================ > Am Montag, 7. November 2005 um 15:36 schrieben Sie: >> On Monday, November 7, 2005 at 2:25:45 PM, [EMAIL PROTECTED] > confabulated: >>> That could be. However, it has been an extremely long time since I've >>> seen a Spam with an image myself. >> My bad for making this statement. I didn't look hard enough. However, >> upon looking at the raw source of the message, SpamAssassin would have >> looked at this: >> <a href=3D"http://www.gfmort.net/book.php";>No, so its here</a><br> >> It would have then looked gfmort.net up on SURBL and would have found: >> URIBL: multi.surbl.org: listed [Blocked, gfmort.net on lists >> [ab][jp][ob][sc][ws], See: http://www.surbl.org/lists.html] >> URIBL: multi.uribl.com: listed [Black, See > http://l.uribl.com/?d=gfmort.net] >> This was a particular Spam advertising low mortgages. Of course the >> image itself didn't have any link to a site. >> -- >> "This message is made of 100% recycled electrons." >> To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html >> List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ >> Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > ============================================ ============================================ -- Mit freundlichen Grüssen -------------------------------------------- Merlin Consulting Martin Schaible Bahnhofstrasse 27 CH-8702 Zollikon Phone: +41 44 391 30 00 Fax: +41 44 391 32 49 Mail: mailto:[EMAIL PROTECTED] URL: http://www.merlinconsulting.ch Support: http://support.merlinconsulting.ch GPS: N47 20.235 E8 34.226 -------------------------------------------- News - Neue Produkte: .:. NOD32 Antivirus System .:. BlueDragon .:. Kiwi Syslog Monitor .:. Paessler GmbH .:. Sawmill Loganalyzer .:. SmarterTools -------------------------------------------- To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
