Re: my solution to image spam (previously mentioendconsistant failures)

Thomas Schürger wrote:
> David A. Lee schrieb:
>> What about inlined external images ?
>> A lot of solicted (aka HAM to me) email has external images.
>>
> External images are obviously not a problem, because they are referenced 
> by some
> URL. spamprobe will quickly be able to decide between spam image URLs and
> ham image URLs.

That's true.  Also some clients will block external images from loading 
(Thunderbird for example) so even if one gets through the victim won't 
see the payload.

I have had some success by switching to -o suspicious-tags on my 
spamprobe command line.  That allows SP to tokenize the attributes of 
font and image tags.  After a few days of this (I didn't rebuild my 
database, just made the switch and watched closely for false positives) 
it seems to have greatly reduced the number of these that get through.

All the best,
++Brian

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV

_______________________________________________
Spamprobe-users mailing list
Spamprobe-users-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
https://lists.sourceforge.net/lists/listinfo/spamprobe-users