I have a problem with spam composed of just a large image containing an advertisement and an id tag at the bottom. This sort of spam is making it through nearly every time. I have bumped up the score on HTML_IMAGE_ONLY to 3.0, which is as high as I dare, but I need another 2 points to get it to 5. Scoring details at bottom of message.
The id tags at the bottom of these stealth spams always look something like this: ekxweaurrmodfisbbzthrimcxkprhttczjnsnfce spbavxpyxrhbtdckvseykfhoycnfhcyxorgdsgyn Two things could be done to improve the blocking of these. First of all, we need to distinguish between images and images that link to a site. If we had an HTML_LINKED_IMAGE_ONLY rule, I could score it much higher and not worry about blocking someone's baby pictures. Second, if there was a way to tag these id codes that show up at the bottom of a message without catching serial numbers in the middle of a genuine message, that would very much help too. The futuristic version (3?) of SpamAssassin I am wildly dreaming of allows me to score based on the location of a phrase in the email. Top, bottom, etc... It also allows me to score extra points for a conjunction of two rules, for instance HTML_IMAGE_ONLY, and REALLY_OBVIOUS_SPAM_ID_STRING. I will see what I can do to write said rules, but having never written SA rules, it may take me a while. Anybody already done this? Let me know. Thanks, Fox Flanders SpamAssassin Results: This mail is probably spam. The original message has been attached along with this report, so you can recognize or block similar unwanted mail in future. See http://spamassassin.org/tag/ for more details. Content preview: URI:http://pgodir.com/p.pl?j03gyMxfEbn561069852PuetLjKx1626.html URI:http://pogld.com/images/100/65.gif swzjglbqejhruckkqvvusyoyrclmwpbowldkvxfq schtvssbqonyviayeluizpawxuummwyitomvkfcx [...] Content analysis details: (3.70 points, 5 required) HTML_60_70 (0.5 points) BODY: Message is 60% to 70% HTML HTML_MESSAGE (0.1 points) BODY: HTML included in message HTML_IMAGE_ONLY_02 (3.0 points) BODY: HTML has images with 0-200 bytes of words MIME_HTML_ONLY (0.1 points) Message only has text/html MIME parts ------------------------------------------------------- This SF.NET email is sponsored by: eBay Great deals on office technology -- on eBay now! Click here: http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
