On Sun, 2006-11-26 at 19:35 +0200, Ira Abramov wrote: > you know the type, lots of random text and the spam is in an attachment > that changes ever so slightly to avoid getting a unique signature for > razor/pyzor and friends.
As mentioned by Peter, bogofilter still does a pretty decent job with these - after a lot of training (I have a combined SPAM and HAM training files over 1GB in size), this type of spam very rarely gets through. I'm using a single bogofilter database for the entire server (a 100 or so active users), and I don't get too many false positives (about a couple a week). > I looked into the text of some of those (got hundreds if not thousands a > day to choose from) and the text is also very topical. this bit of spam > seems obviousely designed for an OSS person (as in, harvested from a web > archive of a technical mailing list?) with words from the FOSS world > mixed in and even "Hebrew" and "rtl" for a more direct hit on some of > us, specific words that will be "kosher" for the bayesian check... I would suspect that the spammers use OSS "friendly words" because most/best spam filters are based on free software, so - fool free software developers and fool everyone. Or so the logic might go. > what do YOU do to fight this? the smartest filter I know is Google's and > even IT fails on some spams every day. I'm using bogofilter as the last line of defense. The first line is a large list of RBLs, including my own RBL with which I aggressively block dynamic IP pools (in addition to specific spammers, mostly Israeli, who aren't blocked by spamhaus and friends). All the image spam is generated by zombie networks, so blocking IP pools used by home subscribers (dial-up/ADSL/Cable/whatever) reduces the spam throughput drasticly. It also saves on processing and network bandwidth as you block spam before its being delivered to you. I'm currently down to about a dozen image spam a day. -- Oded ::.. We promise according to our hopes, and perform according to our fears. ================================================================= To unsubscribe, send mail to [EMAIL PROTECTED] with the word "unsubscribe" in the message body, e.g., run the command echo unsubscribe | mail [EMAIL PROTECTED]
