Ove, could you please do me a favor and confirm that the one I have at
http://www.anfitrion.net/MvPmAyp9yb.gif is also blocked? If you want, I
can send an email to you with the gif attached to it. If it works for
you, then the problem lays with the applications I use with FuzzyOCR to
handle those gif images.
TIA,
Ignacio
Starckjohann, Ove escribió:
> we also get many of these and FuzzyOcr is doing a good job here:
>
> Inhaltsanalyse im Detail: (13.3 Punkte, 5.0 benötigt)
>
> Pkte Regelname Beschreibung
> ---- ---------------------- --------------------------------------------------
> 1.1 EXTRA_MPART_TYPE Unnötige Parameter in "Content-Type"-Kopfzeile
> ("...type=")
> 1.6 FRT_LITTLE BODY: ReplaceTags: Little
> 0.0 HTML_MESSAGE BODY: Nachricht enthält HTML
> 0.0 BAYES_50 BODY: Spamwahrscheinlichkeit nach Bayes-Test:
> 40-60%
> [score: 0.5001]
> 0.8 SARE_GIF_ATTACH FULL: Email has a inline gif
> 0.5 RAZOR2_CHECK Gelistet im "Razor2"-System (http://razor.sf.net/)
> 1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Transportiert via Rechner in Liste von
> www.spamcop.net
> [Blocked - see <http://www.spamcop.net/bl.shtml?213.33.168.29>]
> 0.1 RCVD_IN_IMP_SPAMLIST RBL: Listed in spamrbl.imp.ch
> [213.33.168.29 listed in spamrbl.imp.ch]
> 0.7 MY_CID_AND_STYLE SARE cid and style
> 7.0 FUZZY_OCR BODY: Mail contains an image with common spam
> text inside
> Words found:
> "addressbar" in 1 lines
> "stock" in 1 lines
> "cialis" in 1 lines
> "viagra" in 1 lines
> "xanax" in 1 lines
> (5 word occurrences found)
>
> with details in FuzzyOCR.log:
>
> 2007-06-13 11:15:27 [16507] Saved: /tmp/.spamassassin16507iEX20Ytmp/raw.eml
> 2007-06-13 11:15:27 [16507] Wrote:
> /tmp/.spamassassin16507iEX20Ytmp/wNd2KIniaa.gif
> 2007-06-13 11:15:27 [16507] Found: 1 images
> 2007-06-13 11:15:27 [16507] Errors to:
> /tmp/.spamassassin16507iEX20Ytmp/raw.err
> 2007-06-13 11:15:27 [16507] Analyzing file with content-type="image/gif"
> 2007-06-13 11:15:27 [16507] pfile =>
> /tmp/.spamassassin16507iEX20Ytmp/wNd2KIniaa.gif.pnm
> 2007-06-13 11:15:27 [16507] efile =>
> /tmp/.spamassassin16507iEX20Ytmp/wNd2KIniaa.gif.err
> 2007-06-13 11:15:27 [16507] Found GIF header name="wNd2KIniaa.gif"
> 2007-06-13 11:15:27 [16507] Image is interlaced or animated...
> 2007-06-13 11:15:27 [16507] File contains <4> images, deanimating...
> 2007-06-13 11:15:27 [16507] Calculating the image hash:
> /tmp/.spamassassin16507iEX20Ytmp/wNd2KIniaa.gif.pnm
> 2007-06-13 11:15:27 [16507] Got:
> <337515:250:450:234::252:254:252:253:102091::5:4:5:4:1530::252:3:5:78:964::252:25:24:93:939::219:218:220:219:328::246:233:23
> 3:237:284>
> 2007-06-13 11:15:35 [16507] Expiring
> <201:218:242:216:88485::0:0:255:29:1990::255:0:0:76:984::0:153:255:119:774::153:0:102:57:587::51:51:153:63:509>
> older th
> an 35 days
> 2007-06-13 11:15:36 [16507] Expiring
> <221:255:255:245:49642::255:255:255:255:25621::0:0:255:29:1304::255:0:0:76:710::0:153:255:119:622::153:0:102:57:589>
> old
> er than 35 days
> 2007-06-13 11:15:41 [16507] Trying: $gocr -i $pfile
> 2007-06-13 11:15:41 [16507] Trying: $gocr -l 180 -d 2 -i $pfile
> 2007-06-13 11:15:41 [16507] Trying: $ocrad -c ascii -s5 -T 0.5 $pfile
> 2007-06-13 11:15:41 [16507] Trying: $ocrad -c ascii -s5 $pfile
> 2007-06-13 11:15:42 [16507] Trying: $ocrad -c ascii -s5 -T 0.5 -i $pfile
> 2007-06-13 11:15:42 [16507] Found word "addressbar" in line
> "intheadarssbarofyourbrowsgrhenprejstheenterkey"
> with fuzz of 0.2000 scanned with scanset $ocrad -c
> ascii -s5 $pfile
> 2007-06-13 11:15:42 [16507] Found word "stock" in line
> "lomstpcegugnxebfastoeive"
> with fuzz of 0.2000 scanned with scanset $gocr -l 180
> -d 2 -i $pfile
> 2007-06-13 11:15:42 [16507] Found word "cialis" in line
> "iiciaiisoniyo"
> with fuzz of 0.1667 scanned with scanset $gocr -i
> $pfile
> 2007-06-13 11:15:42 [16507] Found word "cialis" in line
> "cialisonlyoo"
> with fuzz of 0.0000 scanned with scanset $gocr -l 180
> -d 2 -i $pfile
> 2007-06-13 11:15:42 [16507] Found word "viagra" in line
> "viagraniooii"
> with fuzz of 0.0000 scanned with scanset $gocr -i
> $pfile
> 2007-06-13 11:15:42 [16507] Found word "viagra" in line
> "viagraonioo"
> with fuzz of 0.0000 scanned with scanset $gocr -l 180
> -d 2 -i $pfile
> 2007-06-13 11:15:42 [16507] Found word "viagra" in line
> "viaigraonlysoai"
> with fuzz of 0.1667 scanned with scanset $ocrad -c
> ascii -s5 -T 0.5 $pfile
> 2007-06-13 11:15:42 [16507] Found word "viagra" in line
> "viaigraonlygoai"
> with fuzz of 0.1667 scanned with scanset $ocrad -c
> ascii -s5 $pfile
> 2007-06-13 11:15:42 [16507] Found word "xanax" in line
> "xanxinlygoo"
> with fuzz of 0.2000 scanned with scanset $gocr -i
> $pfile
> 2007-06-13 11:15:42 [16507] Found word "xanax" in line
> "xanaxonlygoo"
> with fuzz of 0.0000 scanned with scanset $gocr -l 180
> -d 2 -i $pfile
> 2007-06-13 11:15:42 [16507] Found word "xanax" in line
> "xanaxonlysoo"
> with fuzz of 0.0000 scanned with scanset $ocrad -c
> ascii -s5 -T 0.5 $pfile
> 2007-06-13 11:15:42 [16507] Found word "xanax" in line
> "xanaxonlygoo"
> with fuzz of 0.0000 scanned with scanset $ocrad -c
> ascii -s5 $pfile
> 2007-06-13 11:15:42 [16507] Message is spam, score = 7.000
> 2007-06-13 11:15:42 [16507] Adding Hash to
> "/home/spam/.spamassassin/FuzzyOcr.db"
> 2007-06-13 11:15:42 [16507] Digest:
> 337515:250:450:234::252:254:252:253:102091::5:4:5:4:1530::252:3:5:78:964::252:25:24:93:939::219:218:220:219:328::246:233:
> 233:237:284
> 2007-06-13 11:15:42 [16507] Words found:
> "addressbar" in 1 lines
> "stock" in 1 lines
> "cialis" in 1 lines
> "viagra" in 1 lines
> "xanax" in 1 lines
> (5 word occurrences found)
> 2007-06-13 11:15:42 [16507] Remove DIR: /tmp/.spamassassin16507iEX20Ytmp
> 2007-06-13 11:15:42 [16507] FuzzyOcr ending successfully...
>
>
>
>
> Ove Starckjohann
>
>
>
>> -----Ursprüngliche Nachricht-----
>> Von: Oenus Tech Services [mailto:[EMAIL PROTECTED]
>> Gesendet: Mittwoch, 13. Juni 2007 11:08
>> An: users@spamassassin.apache.org
>> Betreff: Looks like image spam is coming back (fuzzyocr
>> useless in this situation)
>>
>>
>> Some weeks ago I posted a message about fuzzyocr not scoring a spam
>> contents gif file with a broken frame. I got confirmation in the list
>> from Keith De Souza being able to reproduce the problem.
>> Well, it looks
>> like spammers have found their way to deal with fuzzyocr. These days
>> we're getting more and more of those image spam messages. If anyone is
>> interested in testing the file, here it is:
>>
> http://www.anfitrion.net/MvPmAyp9yb.gif
>
> Analysis to the gif file shows that frame #3 is broken.
>
> I'm thinking of disabling fuzzyocr for the time being until the problem
> is solved. However, fuzzyocr is still doing a good job on other files.
> Does anybody have a suggestion or clue on how to solve this? Is there a
> way for fuzzyocr to consider this broken gif images as indecipherable
> and mark it accordingly?
>
> TIA
>
> Ignacio
>
>
