san wrote: > Hello.. > > I have received lots of spam mails like the one i have attached... > > > So I would like to make a rule to detect this kind of spam > I have gone through SARE and i did't get any rule to aviod this and iam ver > new to spam assassin > > Anyone who can make this rule? > Any kind of help is much appreciated > > > Thanks... > http://www.nabble.com/file/3930/acce.htm acce.htm > That looks like just a text-only capture, so we're only seeing part of the message, not the actual message.
I'm making a guess, but does the spam in question have an image (.gif file) attached that contains the advertisement? If so, the SARE stocks ruleset is your best bet. Make sure your SA is set up to use DNSBLs, as most of these "image spams" are sent from hosts listed in XBL. To do this, make sure you have the Net::DNS perl module installed, and make sure you're not using the -L parameter to spamassassin/spamc. Aggressive bayes training with sa-learn helps some, but it's not highly effective against this wave. It does help keep them in the "BAYES_50" zone, instead of lower, but that's not going to catch the spam by itself. Others have been using the FuzzyOCR plugin, but this is a bit expensive in terms of CPU load. It also seems some of the more recent ones are adapting by using cluttered backgrounds.
