Re: Flooded by a SPAM always containing the same picture

2009-05-08 Thread Martin Gregorie
On Fri, 2009-05-08 at 09:27 -0400, Randy wrote: > Also they changed the name > and image ( slightly ) . Now the image is "Gibas.png" or at least, they > are using this too. > They're using a variety of names these days, but all following the fprm you quote: PersonalName.png. I've decoupled my ima

Re: Flooded by a SPAM always containing the same picture

2009-05-08 Thread Randy
Ned Slider wrote: Ned Slider wrote: Martin Gregorie wrote: On Wed, 2009-05-06 at 02:08 +0100, Ned Slider wrote: I had one sneak through today which didn't hit any rules at all (it hits a few DNSBLs now but not when I received it). It contained an inline png: Content-Type: image/png Content-

Re: Flooded by a SPAM always containing the same picture

2009-05-08 Thread Ned Slider
Ned Slider wrote: Martin Gregorie wrote: On Wed, 2009-05-06 at 02:08 +0100, Ned Slider wrote: I had one sneak through today which didn't hit any rules at all (it hits a few DNSBLs now but not when I received it). It contained an inline png: Content-Type: image/png Content-Transfer-Encoding:

Re: Flooded by a SPAM always containing the same picture

2009-05-05 Thread Ned Slider
Martin Gregorie wrote: On Wed, 2009-05-06 at 02:08 +0100, Ned Slider wrote: I had one sneak through today which didn't hit any rules at all (it hits a few DNSBLs now but not when I received it). It contained an inline png: Content-Type: image/png Content-Transfer-Encoding: base64 Content-Dispo

RE: Flooded by a SPAM always containing the same picture

2009-05-05 Thread McDonald, Dan
From: Ned Slider [mailto:n...@unixmail.co.uk] >McDonald, Dan wrote: >> From: Ned Slider [mailto:n...@unixmail.co.uk] >> >>> I had one sneak through today which didn't hit any rules at all (it hits >>> a few DNSBLs now but not when I received it). It contained an inline png: >> >> meta AE_PNG_ATT

Re: Flooded by a SPAM always containing the same picture

2009-05-05 Thread Martin Gregorie
On Wed, 2009-05-06 at 02:08 +0100, Ned Slider wrote: > I had one sneak through today which didn't hit any rules at all (it hits > a few DNSBLs now but not when I received it). It contained an inline png: > > Content-Type: image/png > Content-Transfer-Encoding: base64 > Content-Disposition: inline

Re: Flooded by a SPAM always containing the same picture

2009-05-05 Thread Ned Slider
McDonald, Dan wrote: From: Ned Slider [mailto:n...@unixmail.co.uk] I had one sneak through today which didn't hit any rules at all (it hits a few DNSBLs now but not when I received it). It contained an inline png: Any idea how to tackle these? I have the DSC png rule in place but obvious

Re: Flooded by a SPAM always containing the same picture

2009-05-05 Thread Adam Katz
Ned Slider wrote: > I had one sneak through today which didn't hit any rules at all (it hits > a few DNSBLs now but not when I received it). It contained an inline png: > > Content-Type: image/png > Content-Transfer-Encoding: base64 > Content-Disposition: inline > > here's the full message: > >

Re: Flooded by a SPAM always containing the same picture

2009-05-05 Thread LuKreme
On 5-May-2009, at 19:08, Ned Slider wrote: Content-Type: image/png Content-Transfer-Encoding: base64 Content-Disposition: inline Interesting. I'd think a no-name image would be a pretty strong spam indicator. Didn't it hit the no text rules? I get: Content analysis details: (4.3 points

RE: Flooded by a SPAM always containing the same picture

2009-05-05 Thread McDonald, Dan
From: Ned Slider [mailto:n...@unixmail.co.uk] >I had one sneak through today which didn't hit any rules at all (it hits >a few DNSBLs now but not when I received it). It contained an inline png: >Any idea how to tackle these? I have the DSC png rule in place but >obviously that doesn't appl

Re: Flooded by a SPAM always containing the same picture

2009-05-05 Thread Ned Slider
Randy wrote: Charles Gregory wrote: Just a quick question: I'm noticing that these 'png' spams don't have a text section, or any message body text, and yet my SA does not trigger on any 'message does not contain text' rules? I've seen rules trigger when messages are a high percentage of ima

Re: Flooded by a SPAM always containing the same picture

2009-05-05 Thread John Hardin
On Tue, 5 May 2009, "Adam C?cile (Le_Vert)" wrote: Both my personnal and pro. emails get this stupid spam. Here is the image: http://dedibox.le-vert.net/divers/DSC.png 400x240 DSC\d+.png image spam again. Please check the list archives for the thread with the subject "Almost no score", t

Re: Flooded by a SPAM always containing the same picture

2009-05-05 Thread Randy
Adam Cécile (Le_Vert) wrote: RW a écrit : On Tue, 5 May 2009 14:44:29 +0200 Matus UHLAR - fantomas wrote: On 05.05.09 14:16, "Adam Cécile (Le_Vert)" wrote: Both my personnal and pro. emails get this stupid spam. Here is the image: http://dedibox.le-vert.net/divers/DSC.png Is there

Re: Flooded by a SPAM always containing the same picture

2009-05-05 Thread Randy
Charles Gregory wrote: Just a quick question: I'm noticing that these 'png' spams don't have a text section, or any message body text, and yet my SA does not trigger on any 'message does not contain text' rules? I've seen rules trigger when messages are a high percentage of image versus text

Re: Flooded by a SPAM always containing the same picture

2009-05-05 Thread Charles Gregory
Just a quick question: I'm noticing that these 'png' spams don't have a text section, or any message body text, and yet my SA does not trigger on any 'message does not contain text' rules? I've seen rules trigger when messages are a high percentage of image versus text, but why no hits when 1

Re: Flooded by a SPAM always containing the same picture

2009-05-05 Thread Adam Cécile (Le_Vert)
RW a écrit : On Tue, 5 May 2009 14:44:29 +0200 Matus UHLAR - fantomas wrote: On 05.05.09 14:16, "Adam Cécile (Le_Vert)" wrote: Both my personnal and pro. emails get this stupid spam. Here is the image: http://dedibox.le-vert.net/divers/DSC.png Is there any rules that can block it

Re: Flooded by a SPAM always containing the same picture

2009-05-05 Thread RW
On Tue, 5 May 2009 14:44:29 +0200 Matus UHLAR - fantomas wrote: > On 05.05.09 14:16, "Adam Cécile (Le_Vert)" wrote: > > Both my personnal and pro. emails get this stupid spam. > > Here is the image: http://dedibox.le-vert.net/divers/DSC.png > > > > Is there any rules that can block it ? It se

Re: Flooded by a SPAM always containing the same picture

2009-05-05 Thread Randy
Adam Cécile (Le_Vert) wrote: Hello, Both my personnal and pro. emails get this stupid spam. Here is the image: http://dedibox.le-vert.net/divers/DSC.png Is there any rules that can block it ? It seems the picture is always the same. Thanks in advance, Regards, Adam. You may be flooded n

Re: Flooded by a SPAM always containing the same picture

2009-05-05 Thread Martin Gregorie
On Tue, 2009-05-05 at 14:16 +0200, "Adam Cécile (Le_Vert)" wrote: > Both my personnal and pro. emails get this stupid spam. > Here is the image: http://dedibox.le-vert.net/divers/DSC.png > > Is there any rules that can block it ? It seems the picture is always > the same. > Most stop these mes

Re: Flooded by a SPAM always containing the same picture

2009-05-05 Thread Matus UHLAR - fantomas
On 05.05.09 14:16, "Adam Cécile (Le_Vert)" wrote: > Both my personnal and pro. emails get this stupid spam. > Here is the image: http://dedibox.le-vert.net/divers/DSC.png > > Is there any rules that can block it ? It seems the picture is always > the same. OCR module like FuzzyOCR should cat

Flooded by a SPAM always containing the same picture

2009-05-05 Thread Adam Cécile (Le_Vert)
Hello, Both my personnal and pro. emails get this stupid spam. Here is the image: http://dedibox.le-vert.net/divers/DSC.png Is there any rules that can block it ? It seems the picture is always the same. Thanks in advance, Regards, Adam.