RE: SPAM with images (and some junk text)

	Forums Register Login My Profile Inbox Address Book My Subscription My Forums Member List Search FAQ Ticket List Log Out

RE: SPAM with images (and some junk text)

Logged in as: Guest

Users viewing this topic: none

Printable Version

All Forums >> [Web & Mail Security] >> GFI MailEssentials >> RE: SPAM with images (and some junk text)

Page: << < prev 9 10 11 [12] 13 next > >>

Message

<< Older Topic Newer Topic >>

RE: SPAM with images (and some junk text) - 22.Nov.2006 1:52:45 PM

bhamren

Posts: 36
Joined: 28.Jul.2005
From: Sidney, OH
Status: offline

http://www.spamhaus.org/zen/

(in reply to Mhuijgen)

Post #: 166

RE: SPAM with images (and some junk text) - 22.Nov.2006 1:57:15 PM

Mhuijgen

Posts: 41
Joined: 4.Aug.2005
From: Rotterdam
Status: offline

Right on! Thanks for the notification bhamren and Ceth Eslick :)

< Message edited by Mhuijgen -- 22.Nov.2006 1:59:15 PM >

(in reply to bhamren)

Post #: 167

RE: SPAM with images (and some junk text) - 22.Nov.2006 5:15:41 PM

Mats Bjur

Posts: 109
Joined: 9.Sep.2004
From: Gothenburg, Sweden
Status: offline

Can GFI confirm that MailEssentials supports the return codes that zen.spamhaus.org generates?

(in reply to Mhuijgen)

Post #: 168

RE: SPAM with images (and some junk text) - 22.Nov.2006 5:25:12 PM

Mhuijgen

Posts: 41
Joined: 4.Aug.2005
From: Rotterdam
Status: offline

I think it doesn't matter. You'll get 127.0.0.x returned and that resolves to nothing. Nothing on the internet anyway. I'm using it now and it seems to work fine :) However I'm not with GFI so they'll have to answer your question if you want to be sure.

/edit
Here's a couple of entries from my dnsbl logfile:

"11/22/06 20:41:55","DNS Blacklist","Rarrelsitsxip@lycosmail.co.uk","local@address.here","Riesenpalmen ab 129,- statt 399,-","Tagged","Sending mail server found on zen.spamhaus.org"
"11/22/06 21:40:36","DNS Blacklist","gagnei@cailand.it","local@address.here","Re: hi","Tagged","Sending mail server found on zen.spamhaus.org"
"11/22/06 23:02:46","DNS Blacklist","sjdw94689476@yahoo.com.cn","local@address.here","??,??A?H????,????!","Tagged","Sending mail server found on zen.spamhaus.org"

< Message edited by Mhuijgen -- 22.Nov.2006 5:36:30 PM >

(in reply to Mats Bjur)

Post #: 169

RE: SPAM with images (and some junk text) - 23.Nov.2006 7:43:33 AM

Patrizia

Posts: 8474
Joined: 18.Aug.2003
From: Malta
Status: offline

Hi,

We can confirm that zen.spamhaus.org works with GFI MailEssentials.

_____________________________

Patrizia Caruana
GFI Software - www.gfi.com
Messaging, Content Security & Network Security Software

(in reply to Mhuijgen)

Post #: 170

RE: SPAM with images (and some junk text) - 23.Nov.2006 1:15:25 PM

Henripaul

Posts: 18
Joined: 21.Aug.2006
Status: offline

anoyne have good feedback of this ptach.... i can`t say much since i just installed it

(in reply to Patrizia)

Post #: 171

RE: SPAM with images (and some junk text) - 23.Nov.2006 2:08:45 PM

Mhuijgen

Posts: 41
Joined: 4.Aug.2005
From: Rotterdam
Status: offline

Well... it works. Whichever list you put at the top of your dnsbl's gives the most hits. Zen combines Spamhaus's XBL, SBL and PBL and will eventually replace sbl-xbl so there's really no reason not to use if you use sbl-xbl or one of those now. It's the same list only with a different name.

(in reply to Henripaul)

Post #: 172

RE: SPAM with images (and some junk text) - 23.Nov.2006 2:44:08 PM

Mhuijgen

Posts: 41
Joined: 4.Aug.2005
From: Rotterdam
Status: offline

Justinr, in this post http://forums.gfi.com/m_900735899/mpage_3/key_cbl.abuseat.org/tm.htm#900737137 you mention that you use both cbl.abuseeat.org and sbl-xbl.spamhaus.org (soon to be named zen.spamhaus.org). I read on http://www.spamhaus.org/xbl/ that xbl, included in zen, incorporates cbl.abuseat.org.

So querying both cbl.abuseat.org and zen.spamhaus.org (or sbl-xbl.spamhaus.org) is redundant. You can drop cbl.abuseat.org.

(in reply to Mhuijgen)

Post #: 173

RE: SPAM with images (and some junk text) - 23.Nov.2006 6:20:34 PM

Jim

Posts: 7
Joined: 10.Aug.2006
Status: offline

So far the newimagecheck thing works great against those image spam for us. However we also got some false positives with emails with embedded signatures.

I think an OCR check or something like that would be needed in the future versions / patches of MailEssentials.

-----EDIT-----
Please no adverts

< Message edited by Nicks -- 24.Nov.2006 6:47:15 AM >

(in reply to Mhuijgen)

Post #: 174

RE: SPAM with images (and some junk text) - 24.Nov.2006 6:53:49 AM

Nicks

Posts: 2741
Joined: 17.Mar.2003
Status: offline

Hi Jim,

Thank you for your feedback.

We do enable the use of the auto-whitelist, so as to minimise as much as possible such false positives. Using the Auto-whitelist, emails coming from your existing business partners will not be blocked by MailEssentials.

You would probably still need to keep a look out for emails coming from new business partners, who make use of particular types of images in their signature. False positives from these type of emails can be further avoided by using the keyword whitelist, where you can insert keywords or terms that are specific to your industry.

_____________________________

Nicholas Sciberras
GFI Software - www.gfi.com
Messaging, Content Security & Network Security Software

(in reply to Jim)

Post #: 175

RE: SPAM with images (and some junk text) - 24.Nov.2006 12:06:37 PM

mlegge

Posts: 5
Joined: 22.Nov.2005
Status: offline

Is there any word on when or if GFI will have this patch or another "fix" available to customers using version 11 other then upgrading? We have been dealing with this image spam for almost the better part of a year now with no fix. In terms of business sense and customer retention this is plain unacceptable. I am considering removing this software from our servers. Imagine having to wait 9-10 months for an antivirus update from Symantec or the other various venders, it wouldn't fly and we shouldn't expect to see it taking this long for a spam problem that is basically rendering GFI's software useless.

(in reply to Nicks)

Post #: 176

RE: SPAM with images (and some junk text) - 26.Nov.2006 10:43:16 PM

Jim

Posts: 7
Joined: 10.Aug.2006
Status: offline

mlegge:
In these few days we found that Bayesian filter got almost all of those image spams before they reach Header Checking. I don't know if v11 got Bayesian filter, but seems it works quite well after feeding it over 100 of thoese image spams. Worth a try.

(in reply to mlegge)

Post #: 177

RE: SPAM with images (and some junk text) - 30.Nov.2006 10:55:13 AM

mlegge

Posts: 5
Joined: 22.Nov.2005
Status: offline

Jim, So are you suggesting that I add these image spam email messages to the public folders as spam so that the Bayesian will learn from them. I think that is not the best idea because almost all of these emails have hundreds of legitimate words or no words at all. I am assuming if I did this the Bayesian filter would start to filter legitimate emails because I am feeding it legitimate words. What is GFI's suggestion on this matter can we please get a post from GFI........

(in reply to Jim)

Post #: 178

RE: SPAM with images (and some junk text) - 1.Dec.2006 8:40:30 AM

Patrizia

Posts: 8474
Joined: 18.Aug.2003
From: Malta
Status: offline

mlegge,

We do recommend that these mails are used to train the Bayesian with as spam. If you have trained the Bayesian filter with ham emails suffeciently well, and are also using the auto-whitelist, you should not encounter false positives by training the Bayesian filter in this way.

_____________________________

Patrizia Caruana
GFI Software - www.gfi.com
Messaging, Content Security & Network Security Software

(in reply to mlegge)

Post #: 179

RE: SPAM with images (and some junk text) - 27.Dec.2006 12:44:59 PM

gregstigers

Posts: 7
Joined: 2.Feb.2006
Status: offline

justinr,

I believe that one of the bls, perhaps sbl-xbl.spamhaus.org, uses cbl.abuseat.org, so having both is redundant. And ORDB is closing up shop.

_____________________________

Greg Stigers

(in reply to justinr)

Post #: 180