New threat hops onto spam wagon

These days anyone who sends me an email with a gif in it who's not in my address book - straight to junk.
 
I find that this filter "message_body contains "Content-Transfer-Encoding: base64" catches all image spam, though my cPanel.
 
I find that a standard Spamassassin installation on my SMTP server gets rid of most.

The big thing about spam is, it has to be clickable and Spamassassin utilises black lists based on known baddy URL's.
 
kaspaas said:
I find that a standard Spamassassin installation on my SMTP server gets rid of most.

The big thing about spam is, it has to be clickable and Spamassassin utilises black lists based on known baddy URL's.
Click to expand...

That's probably not going to work for very long due to the problem of spoofed domains. The false positive rate is very high with black lists.
Take for example blacklisting <everyone>@mweb.co.za, because you get a few spoofed addresses from that domain like <random-meaningless-characters>@mweb.co.za.

Also you don't have to do anything "unsafe" yourself to have ur address/domain spoofed.
 
BobJones said:
That's probably not going to work for very long due to the problem of spoofed domains. The false positive rate is very high with black lists.
Take for example blacklisting <everyone>@mweb.co.za, because you get a few spoofed addresses from that domain like <random-meaningless-characters>@mweb.co.za.

Also you don't have to do anything "unsafe" yourself to have ur address/domain spoofed.
Click to expand...


Do yourself a favour and see the way Spamassassin has been structured. It uses piles of tests to determine if mail is spam or not.

http://spamassassin.apache.org/

In this case I'm not referring to email addresses that are spoofed, but to the URL's like http://buy.viagra.com which has to be valid to be of use.

I've been running Spamassassin for almost a year, and the false positives are minimal - mostly mail from Yahoogroups.

I'm using the following sequence of tests:

Originating IP must not be in a Dial-up black list
Greylisting
Spamassassin

The first test eliminates about 40% of all spam, the second another 40% and Spamassassin almost all of the remainder.
 
kaspaas said:
In this case I'm not referring to email addresses that are spoofed, but to the URL's like http://buy.viagra.com which has to be valid to be of use.

I've been running Spamassassin for almost a year, and the false positives are minimal - mostly mail from Yahoogroups.
Click to expand...

OK... I don't get what you are trying to say? The URL's u are referring to are the ones embedded in the spam? The site that is selling the rip-off meds etc?

Can you elaborate?
I thought the problem with picture spam was that the filters had more difficulty scanning the contents?
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X