Hi The sare and fred rules from www.rulesemporium.com are useful here.
Also DCC pyzor and razor2 can help. Also make sure you've sa-updated the latest 3.1.7 core rules as these have some tuning to help.. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -----Original Message----- > From: Johnson, S [mailto:[EMAIL PROTECTED] > Sent: 23 January 2007 16:46 > To: users@spamassassin.apache.org > Subject: market buy with image > > I've got a particular type of spam that is driving me nuts here. It's the > same type of message coming from many different servers (I'm not sure how > many yet, but the first 8 messages of this type I've looked at are all > different). Basically, each message has a random subject followed by a > small jumbled paragraph then there is an image with the message "investor > alert, stock symbol, etc..." (Are people really that stupid to invest into > something like this? =O) and finally another jumbled paragraph. > > > > When I looked up the IP addresses in the RBLs, they all are free and > clear. I was thinking about adding in a optical recognition but there's > "noise" in the image that may make it hard for the program to read. > > > > I'm sure we're not the only ones receiving this type of spam... What are > people doing to stop it? ********************************************************************** Confidentiality : This e-mail and any attachments are intended for the addressee only and may be confidential. If they come to you in error you must take no action based on them, nor must you copy or show them to anyone. Please advise the sender by replying to this e-mail immediately and then delete the original from your computer. Opinion : Any opinions expressed in this e-mail are entirely those of the author and unless specifically stated to the contrary, are not necessarily those of the author's employer. Security Warning : Internet e-mail is not necessarily a secure communications medium and can be subject to data corruption. We advise that you consider this fact when e-mailing us. Viruses : We have taken steps to ensure that this e-mail and any attachments are free from known viruses but in keeping with good computing practice, you should ensure that they are virus free. Red Lion 49 Ltd T/A Solid State Logic Registered as a limited company in England and Wales (Company No:5362730) Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU, United Kingdom **********************************************************************
