On 25.09.22 13:35, Alex wrote:
I've asked variations of this question in the past, but I'm still not sure
what to do about it. Should an email with just an image attachment, with no
subject and no body be treated as spam? This is the circumstance where
users are using email as a file transfer device.
There seems to be one irregularity with this email that causes it to be
marked as spam:
* 1.8 MIME_IMAGE_JPG contains wrong MIME type image\\/jpg
correct mime type is image/jpeg
but should that be enough? Here are the other spam indicators for this
message where only a 9MB attachment was included:
* 0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60%
you can train these, if it makes sense
* 0.2 KAM_BLANKSUBJECT Message has a blank Subject
* 0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in
* 0.8 MPART_ALT_DIFF BODY: HTML and text parts are different
so, does the message contain something or doesn't it? looks like either HTML
or text part does contain something.
* 1.8 MIME_IMAGE_JPG contains wrong MIME type image\\/jpg
* 1.2 HTML_IMAGE_ONLY_04 BODY: HTML: images with 0-400 bytes of words
* 2.3 EMPTY_MESSAGE Message appears to have no textual parts and no
* Subject: text
sending empty message with empty subject really looks like spam
It otherwise hit no local rules, passed SPF and DKIM as it went through
gmail, and even had TXREP deduct a point.
Perhaps we create a meta rule that deducts points for instances where all
of these rules are hit, indicating it was just an image attachment?
What are others doing here? This is with the latest SA v4 from svn.
If you can advise the sender not to send blank subject/body, AND possibly to
fix the mime type, your problem is over
otherwise, you can put the sender into welcomelist_auth
--
Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Despite the cost of living, have you noticed how popular it remains?
