Image SPAM

Hi Gang!
I was wondering if I could get some help with my SA config to beef up the capacity to block image SPAM from coming thru. We've already configured with Alex's awesome tutorials and have users submitting to the spamtrainer account to not much avail. I found an example of what would need to be done here:
http://devroot.org/2006/12/12/spamassassin-tweaks-for-new-spam-methods/
But I'm not totally sure how to apply it to our config without hosing it.
Thanks!

Jeremy,
most image spam nowadays should be caught fine by a properly tweaked amavisd/spamassassin configuration and the addition of some rules.
That said, to install the extra SARE rules mentioned, simply use spamtrainer and issue:
sudo spamtrainer -a
If you still need it, you can install the ImageInfo plugin from here:
http://www.rulesemporium.com/plugins.htm
Quick procedure in Terminal:
sudo -s
cd /etc/mail/spamassassin
curl -O http://www.rulesemporium.com/plugins/ImageInfo.pm
curl -O http://www.rulesemporium.com/plugins/ImageInfo.cf
Edit /etc/mail/spamassassin/init.pre and add (at the bottom of the file):
loadplugin Mail::SpamAssassin::Plugin::ImageInfo /etc/mail/spamassassin/ImageInfo.pm
Restart amavisd by issuing:
/bin/launchctl unload /System/Library/LaunchDaemons/org.amavis.amavisd.plist
/bin/launchctl load /System/Library/LaunchDaemons/org.amavis.amavisd.plist
You may also want to fine tune your amavisd.conf settings:
http://www200.pair.com/mecham/spam/amavisd-settings.html
HTH,
Alex
Message was edited by: pterobyte

Similar Messages

Anyone have luck beating the new image spam with "rules"?

Has anyone figured out how to write rules that block that very annoying new (dozen-message-per-day) image spam? The kind with "torn" bits that reassemble to defeat my ISP's spam-words filters?
Personally, I favor the death penalty for the producers, and at least a cane lashing to anyone who replies, but since that's not going to happen in my lifetime, I want to banish this drivel from my box.
I've tried a few things, but I'm not finding the magic bullet(s). These parasitic missives must have something in common that I can utilize to redirect the junk into electronic Gehenna.
If there are no solutions in the Mac Mail rules settings, I'll probably make draconian changes in the settings my ISP provides, but that means I'll also be blocking a lot of mail I want.

Rules for this kind of messages have been suggested in many places, including this forum, and Allan has already provided two examples.
I personally believe such rules are a bad idea and a waste of time. IMO, the best way to deal with those messages is to just manually mark them as junk. Contrary to what many people think, Mail’s built-in junk filter can learn to recognize those messages as junk; it takes more time that with other types of junk, but it works pretty well. I don’t have any such rules set up in Mail, yet in my case the junk filter correctly marks almost all of them as junk without me having to do anything else.

Image SPAM (Played out)

I know that most of you are tired of hearing about Image SPAM. It seems like a new article is written ever day or so:
http://news.google.com/news?hl=en&ned=us&q=image+spam
I'm curious. I have to give a short presentation to some management in IS, and would like to know what others are seeing and what you're doing to combat it. While the articles seem to indicate that it is growing, it seems to have dropped off (at least for me) in the past couple of weeks. Anyone have any idea what some of the AntiSPAM companies are doing to be able to claim that they're blocking it? I think that Senderbase is what is blocking most of ours, but I'm not completely sure of that. To be honest, I haven't had much time to really dig into it lately.

I've seen a big increase in the amount of image spam, I spoke with Ironport support and they had me use the following filter:
stock_spam:
if ((recv-listener == "IncomingMail") AND (body-size < 63488) AND
(attachment-filetype == "gif") AND (attachment-size < 61440) AND
(body-contains("(?i)cid:[0-9a-zA-Z]")))
quarantine ("Policy");
That filter will catch a lot of image spam. Unfortunately, it will also catch a lot of legitimate messages, too. Within two minutes of enabling that filter on our system, it had quarantined 8 messages, but 2 of them were from vendors we work with regularly. Seems to be quite a few legitimate applications that generate messages containing inline graphic attachments, and this filter will stop all of them.
I've noticed that Outlook with Word as the editor will generate messages with inline graphic attachments, so anyone who uses this and includes a logo in their signature will run into this. Just FYI. I've seen messages from Microsoft support people get caught by these types of filters. Not good for business, so we just have to put up with the spam until we can find a better way to filter it out, but this isn't the solution.

Have working image spam rule, but need to stop the beeping!

http://www.tuaw.com/2006/08/04/a-mail-app-rule-for-catching-image-spam/
This tip from TUAW to reliably sends all the image spam I've been receiving lately to my Junk box. However Mail.app still does the "New mail sound" when one of these spam emails arrives and is moved to my Junk box. Any ideas on how to disable this sound on the spam emails only?

You can't really change the target class of a monitor in a sealed vendor pack. If this is your own custom pack, then you can change the target class no problem, but this would need to be done on the unsealed XML (using VSAE or some other authoring tool).
Then you can seal the pack and re-import (should be upgrade compatible, since you are just changing the target).
I'm not familiar with this particular monitor in your screenshot, but it looks like this should probably target Exchange? If this is the case, then I would recommend targeting the closest typed class that the monitor should run against. In this case, some
type of Exchange class that is already in the Exchange management pack.
Otherwise, you can also create your own custom class for targeting, which I describe in detail on my blog.
Here are all my sample VSAE fragments.
Here is an example of
using the Application Component base for your new class.
Here is an example of
using Local Application base for your new class.
Jonathan Almquist | SCOMskills, LLC (http://scomskills.com)

Image Processor Greying Out

Hi everyone:
I have been using the Image Processor Script for years to resize my tifs to jpegs. Recently, I have come across a problem. The folders that I want to select are greyed out and I am unable to select the correct folders for making my jpegs. The folder properties are correct. Does anyone have any suggestions about how I can select the correct folders? I appreciate your time and thoughts. Thank you very much for your assistance.

I've seen a big increase in the amount of image spam, I spoke with Ironport support and they had me use the following filter:
stock_spam:
if ((recv-listener == "IncomingMail") AND (body-size < 63488) AND
(attachment-filetype == "gif") AND (attachment-size < 61440) AND
(body-contains("(?i)cid:[0-9a-zA-Z]")))
quarantine ("Policy");
That filter will catch a lot of image spam. Unfortunately, it will also catch a lot of legitimate messages, too. Within two minutes of enabling that filter on our system, it had quarantined 8 messages, but 2 of them were from vendors we work with regularly. Seems to be quite a few legitimate applications that generate messages containing inline graphic attachments, and this filter will stop all of them.
I've noticed that Outlook with Word as the editor will generate messages with inline graphic attachments, so anyone who uses this and includes a logo in their signature will run into this. Just FYI. I've seen messages from Microsoft support people get caught by these types of filters. Not good for business, so we just have to put up with the spam until we can find a better way to filter it out, but this isn't the solution.

Fuzzy OCR - Step by Step guide

I'm having a nightmare with SPAM emails disguised as gif attachments. I've tried banning them using postfix header checks which works very efficiently but a lot of clients use gif attachments as signature files and the default message from postfix is a bit too ambiguous, I don't feel confident enough to recompile postfix to customise the message.
So, I read about Fuzzy OCR plugin for Spamassasin:
http://wiki.apache.org/spamassassin/FuzzyOcrPlugin
It sounds great only I'm slightly nervous about it after reading a thread about 10.4.9, Perl, amavis and Net::Server. Before I attempt to install it does anybody have a nice "step by step" that is 10.4.9 safe or some advice on the installation process? I know it has instructions on the link but I feel there maybe more to with Mac OS X Server's Implementation. I'm currently running 10.4.8.
Much appreciated.
Huw.

Have never seen a need for this, so I am not able to give you step by step instructions. I did have a look at the instructions and it seems pretty straightforward to me (which doesn't mean it couldn't break something). It does require a newer version of Spamassassin than the one that comes with OS X Server.
Having said that, I am not sure it's worth the effort. While it is true that some image spam makes it past spamassassin, if configured properly it should be very little. The latest batch of image spam circulating these days, regulary hits scores above 7 without any Fuzzy OCR installed on my server.
Furthermore, spammers have learned to distort the images well enough for OCR software to have trouble with, so I believe the usefulness will actually decrease.
I know, this is not what you asked for, but I thought it's worth mentioning.
I don't know hwo your system is configured, but I'd look at optimising first. Adding rules for example does help a lot. As does properly configuring postfix.
Alex

When entering the digits from an Anti Spam Image they are not accepted by the host web site why

In e-bay when required to enter the digits from an anti spam image, ebay rejects the entered digets.
This only occurs when using Firefox, Internet explorer works fine.
Any body know why?

hi john, you probably have to go trough your list of addons once (in the firefox ''menu ≡ > addons > extensions'') and disable them one by one to find out which in particular might be causing the problem.

Actually I have a problem is this when i submit my articles on Website the error is showin ANTI SPAM USER ID or 2nd one is this IMAGE CODE not showing Please please help me

IMAGE CODE NOT SHOWING AND WHEN I POST ARTICLES ON WEBSITE SO THE ERROR WAS SHOWS ( ANTI SPAM USER ID ) EVEN I HAVE ALREADY LOGIN THAT WEBSITE ....
KINDLY TELL ME ABOUT THIS PROBLEM
== This happened ==
Every time Firefox opened
== Everytime when i visit websites

Start Firefox in [[Safe Mode]] to check if one of your add-ons is causing your problem (switch to the DEFAULT theme: Tools > Add-ons > Themes).
See [[Troubleshooting extensions and themes]] and [[Troubleshooting plugins]]
See also [[Images or animations do not show]] and http://kb.mozillazine.org/Images_or_animations_do_not_load

Include Image using cid:... then receiving to Junk folder

Hi All,
I'm trying to include an image to the mail.
Image is correctly included.. but the mail is receiving to Junk folder in OutLook. Whats wrong? Pls help me.
My code:
MimeBodyPart mbp1 = new MimeBodyPart();
         mbp1.setContent(" <HTML><BODY>" +
                   "<img src=\"cid:image001\">" +
                              "</BODY></HTML>", "text/html; charset=\"iso-8859-1\"");
MimeBodyPart mbp2 = new MimeBodyPart();
FileDataSource fds = new FileDataSource("F:\\image\\image.jpg") {
          public String getContentType() {
              return "IMAGE/JPG";
         mbp2.setDataHandler(new DataHandler(fds));
mbp2.setHeader("Content-ID", "<image001>");
Multipart mp = new MimeMultipart("related");
         mp.addBodyPart(mbp1);
         mp.addBodyPart(mbp2);
         msg.setContent(mp);
msg.saveChanges();

Well, obviously the receiver thinks your message looks like spam.
If it's not really spam, you'll have to change it in some way to look
less like spam. But every spam filter has different rules and there's
no way to tell you exactly what to do to get your message past
any particular spam filter.

Lately, I'm unable to paste any image into the body of any email I compose. I did not have this issue before today. Please help.

Could this issue with not being able to copy and paste any image within the email body, be virus or malware related?
Though I don't think I have any virus problems. Also I have all the latest updates for Thunderbird.
I read some suggestions posted elsewhere and tried those but none of these worked :
DID NOT WORK #1 :
(If your Thunderbird email message is displaying strange-looking code (tags) after each link, images are missing (it looks like images have been stripped out), and the font appears different, or bold, then you’ve most likely changed the message body view inadvertently. To switch it back, simply:
Browse to View -> Message Body As -> and select Original HTML.)
DID NOT WORK #2 :
Email message looks fine, but doesn’t contain images
If the rest of your Thunderbird email message looks okay, but is missing images, or they appear to have been stripped out, it’s very possible that you’ve changed a setting that won’t let attachments (ie. pictures) appear inline (within the message body). To change this back, simply:
Browse to View -> and select Display Attachments Inline. )
DID NOT WORK #3 :
If you made the above changes to your Thunderbird settings and images still aren’t appearing in some of your messages, it may be that Thunderbird is blocking them because it thinks they are spam. To adjust your privacy settings and prevent the images from being stripped out, or not displaying at all (ie. being blocked), simply:
Click on the button to the above right of the email message asking you whether you would like to load images.
If the email message is from a trusted sender, you can click the link above the message specifying you would always like to load images in messages from this particular sender.
DID NOT WORK #4 :
If you’re still having troubles, or your changes aren’t being saved (ie. next time you open Thunderbird the images won’t display again) you can directly specify the default format Thunderbird should display email messages as in the config editor. To access it, simply:
Browse to Tools -> Options -> Advanced tab -> Config Editor
Search for mail.default_html_action and make sure it is set to 3 (allow original HTML). If you would like messages to open as text only (more secure, but you won’t see images, change the setting to 1).
Could you please suggest what possibly has caused this issue? Thank you for your time.

Thank you for your response.
After searching around for any pointers to my problem, the above fixes I listed were the things that came closest to maybe addressing the issue, that I was able to locate. But since none worked, and as you pointed out, it is now clear they will only help towards viewing sent images rather than helping with inserting any images in the body of the email, which is the problem I suddenly started facing today.
Coming to your suggestion, on opening the Write window, the Insert choice on the menu bar is indeed available. And I had already tried using that, by clicking on the '''Insert ----> Image''' option listed. That opens
up the "Image Properties" box but using that has not resolved the matter either. It results in an image box getting inserted within the email but without the actual image itself.
Plus, normally I am able to use the '''Paste''' function in the Edit menu or through right-click, but today the (Cut/Copy/Paste) functions have gone inactive, thereby disallowing me to use that to place an image within the email.

How can I avoid ending up in Junk/Spam folders

Hello,
I wish to send out emails using "mail" to some art galleries and I am concerned about ending up in peoples junk/spam folder.
Can anyone tell me what are the most likely characteristics of an email that will send them directly to someone's junk folder? I was previously sending a few pix (some jpgs dragged and dropped directly into the message field) that made each message around 500kb
I am now thinking that 500kb might put me in junk???
would it be better to send a small image (around 30 - 40kb) with each email or is image size not a determining factor here?
I also want to send single messages to multiple addresses using the Bcc: field. would sending to multiple addresses also penalize each message or is there some recommended limit (e.g to send 10 emails max at a time) so as not to be junked?
I suppose a lot depends here on the settings used by each recipient, but it would be good to have some general advice on good practice.
Many thanks in advance
Mark

Can anyone tell me what are the most likely characteristics of an email that will send them directly to someone's junk folder?
That's completely different for everyone, and it also depends on who their email provider is, since most spam filtering is done at their end first. Using certain words or phrases in the Subject line that are known to be associated with spam is something to avoid. In other words, use complete, grammatically correct phrases or sentences for the Subject.
Attachments may be a trigger for some spam filters, but unless you know that in advance, there's no way to plan for it. Image size would not be a factor, unless there's a limit on the size of any single email message. The larger the message, the longer it takes to download and render on the recipient's computer.
Sending multiple emails via the BCC field has no effect on whether or not a message is or isn't spam; only the receiving mail server and/or the recipient's spam filtering software can make that determination. Your email provider probably has a limit on the maximum number of recipients you can include in the CC or BCC field, so you should ask them before doing this.
If you really want to know how your recipients feel, send them each an email about your plans and ask them if they would object or treat such messages as spam.
Mulder

How can I send a ThinkLink image with all the embedded links in Thunderword Email?

As you are aware, ThinkLink images have embedded links (word files, images, videos etc.). I am, however, not able to send these images through Thunderword emails. I have tried both Inset Image and Insert HTML but nothing works. Of course, I can understand that ThinkLink is a new concept and most of the email clients don't support it.
Thanks,

No I am not aware. I have now googled thinklink, joined their site and found that they do not create images. Only Javascript.
So no email client such as Thunderbird, which does not allow javascript, or any person disabling it in their browser for security reasons, will see your interactive images because they are not images they are interactive programs written in Javascript.
Now how to get unsubscribed from these folk, they already tried spamming my whole Google Plusfriends list.

High Amount of Spam on Exchange 2013 - Content Filtering is Enabled but Pfizer Spam Filling Up Everyone's Mailboxes

Hello
Previously I used Exchange 2010 with Forefront Threat Protection installed and this used to do a good job of stopping all the spam.
However since updating to Exchange 2013 earlier this year and enabling the integrated spam filtering everyone noticed a sudden increase in the amount of spam which was getting through which has been bad for a long time.
We have been living with it but in the last 3 weeks everyone has started getting about 40 emails a day from Pfizer for Viagra. All these seem to defeat the content filtering as Viagra is spelt with an extra I and the email address is always different.
Also images in emails are blocked by default but somehow all the images on these spam messages appear for everyone.
I am not sure the spam filtering is working at all and I'm not sure how to tell as ForeFront gives you a nice graphical dashboard but I can find nothing similar to this in Exchange and PowerShell seems the only way to configure the limited functionality
of the content filter.
Is there any way to get rid of these messages as it doesn't look very good when they are constantly popping up for everyone?
Thanks
Robin
Robin Wilson

Hello ManU
Thanks for the reply.
I have checked the logs and see this quite often:
AcceptMessage,,SCL,not available: policy is disabled
But other times it says this:
RejectMessage,550 5.7.1 Message rejected as spam by Content Filtering
Which seems to indicate it is rejecting some.
This is what one of the email headers look like:
Received: from RWS-MAIL.rwsservices.net (192.168.2.151) by
RWS-MAIL.rwsservices.net (192.168.2.151) with Microsoft SMTP Server (TLS) id
15.0.775.38 via Mailbox Transport; Sat, 28 Dec 2013 10:59:26 +0000
Received: from RWS-MAIL.rwsservices.net (192.168.2.151) by
rws-mail.rwsservices.net (192.168.2.151) with Microsoft SMTP Server (TLS) id
15.0.775.38; Sat, 28 Dec 2013 10:58:38 +0000
Received: from [90.169.106.204] (90.169.106.204) by mail.rwsservices.net
(192.168.2.151) with Microsoft SMTP Server id 15.0.775.38 via Frontend
Transport; Sat, 28 Dec 2013 10:58:37 +0000
Date: Sat, 28 Dec 2013 12:05:58 +0200
From: US.Pfizer eStore <[email protected]>
To: robin.wilson <[email protected]>
Message-ID: <[email protected]>
Subject: Dear robin.wilson up to 65% OFF!
X-Mailer: Airmail (223)
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="dd2ee3ea_586bb9e4_6f04"
Return-Path: [email protected]
X-MS-Exchange-Organization-PRD: 001-taxis.co.uk
X-MS-Exchange-Organization-SenderIdResult: Neutral
Received-SPF: Neutral (rws-mail.rwsservices.net: 90.169.106.204 is neither
permitted nor denied by domain of [email protected])
X-MS-Exchange-Organization-Network-Message-Id: e8825204-1f32-48be-a331-08d0d1d30209
X-MS-Exchange-Organization-SCL: 1
X-MS-Exchange-Organization-PCL: 2
X-MS-Exchange-Organization-Antispam-Report: DV:3.3.13223.464;SID:SenderIDStatus Neutral;OrigIP:90.169.106.204
X-EXCLAIMER-MD-CONFIG: 079171ba-394f-46d5-a160-56e416712e8e
X-MS-Exchange-Organization-AVStamp-Enterprise: 1.0
X-MS-Exchange-Organization-AuthSource: rws-mail.rwsservices.net
X-MS-Exchange-Organization-AuthAs: Anonymous
The emails use a different sender email address every time and there is always a poem in very light grey writing in the body of the email. The drugs are always misspelt as well. Is this why these are getting through?
Thanks
Robin
Robin Wilson

Inserting an image to a message post or attaching images to a post or creating a gallery

Hi:
I'm trying to either attach an image to a message post or insert it in-line with a message. I've read several references to this ability perhaps being something that will happen "soon", but those messages that refer to this are dated in August of 2009. Here it is December and I still can't figure out how.
The online help says very clearly:
How do I insert an image in a post?
You insert an image the same way as you did before, but now you have more choices about where the image comes from and how it looks. You can insert an image from your computer (this uploads the image to your gallery), from your image gallery (if the image has been approved), or from another location on the Web.
To insert an image in a post:
Start a new post.
You can insert images anywhere: in messages, replies, blog articles, ideas, or comments.
Click the Insert Image button in the editor's tool bar (it looks like a tree).
Well, I don't know how you could do it "before", but there is no "Insert Image" button in the editor's toolbar at all.
There are also messages in this forum that say you can paste from a Word document (there IS a "Paste from Word" icon on the toolbar.) However, when I paste from word, the images in my Word document are lost.
Finally, I thought I'd post the images in a gallery. Again the online help says:
To upload an image to your image gallery:
Go to your Profile page and click the View Image Gallery link.
Click Browse to select an image file to be uploaded.
If the image is small enough (the size limit is set by your community), the image is uploaded. A preview of the image appears so that you can make sure you uploaded the right image.
There is no "View Image Gallery" link on my profile page.
Now, I am a computer consultant and therefore (hopefully) very computer-savvy, so this is not an issue with me being a forum "novice." But I've always had issues with help documents that say "click on this icon" and don't show a screenshot of where the icon is.
And, I can't PROVE that my profile page doesn't have a gallery link because I can't upload a screenshot! <grin>.
So, can anyone clarify if and how we can upload images? Or if there is a definitive help document that lays this out, provide a link to that document? The help "search" function is pretty weak, because it does a FORUM search on any term you type in, rather than restricting it to help documents.
There's also some references to having to be a "silver member" in order to upload images, but no information on what is required to become such a member.
Thanks
Ron

As stated in the Community Ranking Structure post on the Announcements section:
Many community members will ask (and have asked in the past) exactly what the criteria is for achieving each rank in the hierarchy. To eliminate the likelihood of system abuse or forum ‘rank climbing’, we have decided not to publicize the exact ranking criteria. That said, community members will gain higher ranking by excelling in the activity components below. The list is not in order of importance and some elements are weighted greater than others.
Kudos Given
Kudos Received
Length of Time on the Community
Number of logins
Posts marked as “Accepted Solution”
Total number of Posts (minus deleted posts)
Total Number of Tags applied throughout community
Time spent online in the Community Forums
As members achieve higher rankings within the Community Forums, they will automatically receive additional functionality – while maintaining the functionality rights previously achieved.
This is done to prevent spamming and trolling of the forums and to prevent objectionable content from being uploaded to the site. There are legal issues involved with this and it preserves the integrity of the forums to grant certain permissions at certain ranks.
The ranking structure undergoes periodic review and this may change in the future -- but no guarantees.
If a forum member gives an answer you like, give them the Kudos they deserve. If a member gives you the answer to your question, mark the answer that solved your issue as the accepted solution.

Can you auto-load images in junk mail?

Am I wrong in thinking that once you could make a choice to load images automatically when opening junk mail? Can you now?

No, there is not. It wouldn't be reliable or useful. If Mail filters it as junk, presumably you won't be opening it, and thus loading the images, anyway. On the other hand, if it fails to recognize one message as spam and you open it, you'll load the images and become a "marked man." (ie, your address will be tagged as one where the spam is opened)

Image SPAM

Similar Messages

Maybe you are looking for