>-----Original Message----- >From: Matus UHLAR - fantomas [mailto:uh...@fantomas.sk] >Sent: Thursday, September 1, 2016 14:30 >To: users@spamassassin.apache.org >Subject: Re: Image spam - FuzzyOCR?
>>On Wed, 31 Aug 2016 12:55:15 +0000 Richard Mealing wrote: >>> 2) I'm getting some horny date spam coming through with just >>> images and text inside an image at the bottom. My bayes seems to be >>> scoring this with -1.90 Bayes_00. I keep sending this to my database >>> as spam but I'm not sure how many I need to feed it and I don't get >>> much. >On 01.09.16 14:25, RW wrote: >>It not a good sign when spam resists being trained way from BAYES_00. >> >>IIWY I'd reset the database, and if possible turn-off autotraining and >>train manually. >> >>Also you might want to set: >> >> bayes_token_sources all >> >>This adds in mimepart hashes, which may help Bayes identify repeated >>images. >I think what happens more often is that the training data are sent to wrong >user. >when using amavis, training must be done as 'amavis' user, or other than >amavis runs as. I'm scanning for quite a few different domains (100+) and I'm not that familiar with how bayes works - I can't really find much documentation. TBH it seems to be working fine and scoring quite well, but there are instances where it fails. Also I am using it through sql - use_bayes 1 bayes_auto_learn 1 bayes_auto_expire 1 bayes_store_module Mail::SpamAssassin::BayesStore::SQL bayes_sql_dsn DBI:mysql:sa_bayes:x.x.x.x:3306 bayes_sql_username sa_user bayes_sql_password xxxx I need to do more reading on how to make it better, but I have a few dormant domains delivering emails to a POP box and I rsync that to my filtering server and run sa-learn just using some bash script. I read this isn't recommended though, but I would have thought using a domain that no one should know about, like a honeypot, this should be ok? Maybe I should just rethink the whole thing. I remember someone telling me about that flesh plugin. I'm sure it was my boss! Was it not called pornsweeper? Looks like the DNS was removed for the website, but I looked at googles cached copy.. Thanks for all your advice, it is much appreciated. >-- >Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ >Warning: I wish NOT to receive e-mail advertising to this address. >Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. >"Where do you want to go to die?" [Microsoft]
