Re: Flooded by a SPAM always containing the same picture

2009-05-08 Thread Ned Slider
Ned Slider wrote: Martin Gregorie wrote: On Wed, 2009-05-06 at 02:08 +0100, Ned Slider wrote: I had one sneak through today which didn't hit any rules at all (it hits a few DNSBLs now but not when I received it). It contained an inline png: Content-Type: image/png Content-Transfer-Encoding:

Re: Flooded by a SPAM always containing the same picture

2009-05-08 Thread Randy
Ned Slider wrote: Ned Slider wrote: Martin Gregorie wrote: On Wed, 2009-05-06 at 02:08 +0100, Ned Slider wrote: I had one sneak through today which didn't hit any rules at all (it hits a few DNSBLs now but not when I received it). It contained an inline png: Content-Type: image/png

Re: Flooded by a SPAM always containing the same picture

2009-05-08 Thread Martin Gregorie
On Fri, 2009-05-08 at 09:27 -0400, Randy wrote: Also they changed the name and image ( slightly ) . Now the image is Gibas.png or at least, they are using this too. They're using a variety of names these days, but all following the fprm you quote: PersonalName.png. I've decoupled my image

Flooded by a SPAM always containing the same picture

2009-05-05 Thread Adam Cécile (Le_Vert)
Hello, Both my personnal and pro. emails get this stupid spam. Here is the image: http://dedibox.le-vert.net/divers/DSC.png Is there any rules that can block it ? It seems the picture is always the same. Thanks in advance, Regards, Adam.

Re: Flooded by a SPAM always containing the same picture

2009-05-05 Thread Matus UHLAR - fantomas
On 05.05.09 14:16, Adam Cécile (Le_Vert) wrote: Both my personnal and pro. emails get this stupid spam. Here is the image: http://dedibox.le-vert.net/divers/DSC.png Is there any rules that can block it ? It seems the picture is always the same. OCR module like FuzzyOCR should catch

Re: Flooded by a SPAM always containing the same picture

2009-05-05 Thread Martin Gregorie
On Tue, 2009-05-05 at 14:16 +0200, Adam Cécile (Le_Vert) wrote: Both my personnal and pro. emails get this stupid spam. Here is the image: http://dedibox.le-vert.net/divers/DSC.png Is there any rules that can block it ? It seems the picture is always the same. Most stop these messages

Re: Flooded by a SPAM always containing the same picture

2009-05-05 Thread Randy
Adam Cécile (Le_Vert) wrote: Hello, Both my personnal and pro. emails get this stupid spam. Here is the image: http://dedibox.le-vert.net/divers/DSC.png Is there any rules that can block it ? It seems the picture is always the same. Thanks in advance, Regards, Adam. You may be flooded

Re: Flooded by a SPAM always containing the same picture

2009-05-05 Thread RW
On Tue, 5 May 2009 14:44:29 +0200 Matus UHLAR - fantomas uh...@fantomas.sk wrote: On 05.05.09 14:16, Adam Cécile (Le_Vert) wrote: Both my personnal and pro. emails get this stupid spam. Here is the image: http://dedibox.le-vert.net/divers/DSC.png Is there any rules that can block it

Re: Flooded by a SPAM always containing the same picture

2009-05-05 Thread Adam Cécile (Le_Vert)
RW a écrit : On Tue, 5 May 2009 14:44:29 +0200 Matus UHLAR - fantomas uh...@fantomas.sk wrote: On 05.05.09 14:16, Adam Cécile (Le_Vert) wrote: Both my personnal and pro. emails get this stupid spam. Here is the image: http://dedibox.le-vert.net/divers/DSC.png Is there any rules

Re: Flooded by a SPAM always containing the same picture

2009-05-05 Thread Charles Gregory
Just a quick question: I'm noticing that these 'png' spams don't have a text section, or any message body text, and yet my SA does not trigger on any 'message does not contain text' rules? I've seen rules trigger when messages are a high percentage of image versus text, but why no hits when

Re: Flooded by a SPAM always containing the same picture

2009-05-05 Thread Randy
Charles Gregory wrote: Just a quick question: I'm noticing that these 'png' spams don't have a text section, or any message body text, and yet my SA does not trigger on any 'message does not contain text' rules? I've seen rules trigger when messages are a high percentage of image versus

Re: Flooded by a SPAM always containing the same picture

2009-05-05 Thread Randy
Adam Cécile (Le_Vert) wrote: RW a écrit : On Tue, 5 May 2009 14:44:29 +0200 Matus UHLAR - fantomas uh...@fantomas.sk wrote: On 05.05.09 14:16, Adam Cécile (Le_Vert) wrote: Both my personnal and pro. emails get this stupid spam. Here is the image:

Re: Flooded by a SPAM always containing the same picture

2009-05-05 Thread John Hardin
On Tue, 5 May 2009, Adam C?cile (Le_Vert) wrote: Both my personnal and pro. emails get this stupid spam. Here is the image: http://dedibox.le-vert.net/divers/DSC.png 400x240 DSC\d+.png image spam again. Please check the list archives for the thread with the subject Almost no score,

Re: Flooded by a SPAM always containing the same picture

2009-05-05 Thread Ned Slider
Randy wrote: Charles Gregory wrote: Just a quick question: I'm noticing that these 'png' spams don't have a text section, or any message body text, and yet my SA does not trigger on any 'message does not contain text' rules? I've seen rules trigger when messages are a high percentage of

RE: Flooded by a SPAM always containing the same picture

2009-05-05 Thread McDonald, Dan
From: Ned Slider [mailto:n...@unixmail.co.uk] I had one sneak through today which didn't hit any rules at all (it hits a few DNSBLs now but not when I received it). It contained an inline png: Any idea how to tackle these? I have the DSC png rule in place but obviously that doesn't apply

Re: Flooded by a SPAM always containing the same picture

2009-05-05 Thread LuKreme
On 5-May-2009, at 19:08, Ned Slider wrote: Content-Type: image/png Content-Transfer-Encoding: base64 Content-Disposition: inline Interesting. I'd think a no-name image would be a pretty strong spam indicator. Didn't it hit the no text rules? I get: Content analysis details: (4.3

Re: Flooded by a SPAM always containing the same picture

2009-05-05 Thread Adam Katz
Ned Slider wrote: I had one sneak through today which didn't hit any rules at all (it hits a few DNSBLs now but not when I received it). It contained an inline png: Content-Type: image/png Content-Transfer-Encoding: base64 Content-Disposition: inline here's the full message:

Re: Flooded by a SPAM always containing the same picture

2009-05-05 Thread Ned Slider
McDonald, Dan wrote: From: Ned Slider [mailto:n...@unixmail.co.uk] I had one sneak through today which didn't hit any rules at all (it hits a few DNSBLs now but not when I received it). It contained an inline png: Any idea how to tackle these? I have the DSC png rule in place but

Re: Flooded by a SPAM always containing the same picture

2009-05-05 Thread Martin Gregorie
On Wed, 2009-05-06 at 02:08 +0100, Ned Slider wrote: I had one sneak through today which didn't hit any rules at all (it hits a few DNSBLs now but not when I received it). It contained an inline png: Content-Type: image/png Content-Transfer-Encoding: base64 Content-Disposition: inline

RE: Flooded by a SPAM always containing the same picture

2009-05-05 Thread McDonald, Dan
From: Ned Slider [mailto:n...@unixmail.co.uk] McDonald, Dan wrote: From: Ned Slider [mailto:n...@unixmail.co.uk] I had one sneak through today which didn't hit any rules at all (it hits a few DNSBLs now but not when I received it). It contained an inline png: meta AE_PNG_ATTACH

Re: Flooded by a SPAM always containing the same picture

2009-05-05 Thread Ned Slider
Martin Gregorie wrote: On Wed, 2009-05-06 at 02:08 +0100, Ned Slider wrote: I had one sneak through today which didn't hit any rules at all (it hits a few DNSBLs now but not when I received it). It contained an inline png: Content-Type: image/png Content-Transfer-Encoding: base64