Spamassassin and .png spam

8 posts / 0 new
Last post
#1 Thu, 05/21/2009 - 23:50
pixel_paul
pixel_paul's picture

Spamassassin and .png spam

Hi,

Am wondering if any one has a good idea for stopping this relentless scourge of png based spam getting through to mailboxes - its getting beyond a joke as to how much is coming into client's mailboxes!

The spam comes with a typical distasteful subject and a .png attachment trying to sell you the usual.

Spamassassin really struggles to stop it (as it can't read the image). I understand there is a plugin which may help called FuzzyOcr, but looking for other equally good ideas!

Thanks,

Paul

Fri, 05/22/2009 - 04:46
andreychek

Hi Paul,

This isn't officially supported by Virtualmin by any means... but I did have some luck with that FuzzyOCR plugin you're mentioning.

It's a third party SpamAssassin plugin available here:

http://fuzzyocr.own-hero.net/

Essentially, it can read text on images. So it reads the images in the email, and based on a wordlist, decides if they're spam or not. You can tweak the specific criteria it uses.

While it does work for me, I tuned it down a bunch from the default so that a "hit" wasn't worth as much as they make it by default

On Ubuntu, "fuzzyocr" is available in their repository, so you only need to do "apt-get install fuzzyocr".

On Debian or CentOS, you'll need to install it manually, but there's a few HOWTO's and Tutorial's on that around the Net if the instructions on the FuzzyOCR site don't immediately click for you.
-Eric

Fri, 05/22/2009 - 13:25 (Reply to #2)
ronald
ronald's picture

it's driving me nuts. It started not too long ago. Looks like servers based in China. Products seem to come from Canada.
Oddly enough I only get the spam on two mailboxes.
Per haps time to block China all together.

Sun, 05/24/2009 - 19:31 (Reply to #3)
mrwilder

That sounds like the future to me... didn't know it existed...

It doesn't seem like you were too impressed with it, though. I assume the server load was completely unacceptable?

What did you think?

Sun, 05/24/2009 - 19:59 (Reply to #4)
Joe
Joe's picture

A brief bit of reading and googling seems to indicate that cranking up the spamminess points of the freemail test (a third party plugin for SpamAssassin) might be a less resource intensive alternative for this brand of mail. (Though this assumes most of the mail is coming from freemail services, which I don't know to be the case.)

I'm pretty sure there's a GeoIP plugin out there somewhere, which might be worth looking into, if everything is coming from a specific locality.

--

Check out the forum guidelines!

Tue, 05/26/2009 - 12:21 (Reply to #5)
ronald
ronald's picture

About a year ago I did block a certain country by IP (with .htaccess). Unfortunately the databases where it pulls from, changes regularly. I noticed since the IP of another country got blocked as well (that happened to be the server admin rofl).

Now I use Postgrey since 2 days and spam has gone for now. hooray

Fri, 05/22/2009 - 06:07
pixel_paul
pixel_paul's picture

Hi Eric,

So I suppose you've been experiencing similar spam then?

I'll give it go and see what results I come up.

Cheers,

Paul

Fri, 05/22/2009 - 06:13 (Reply to #7)
andreychek

Yeah, definitely, and lots of it :-)
-Eric

Topic locked