Our current setup of Spamfilter seems to block a large percentage of our spam, however, we just can't seem to get the settings right that will block the pump and dump stock spam emails that come with image attachments. We cannot find a balance between blocking the spam images and allowing normal images just as signatures, headers and footers. Has anyone had any luck with effective blocking of this type of spam? If so, PLEASE TELL ME HOW.....

Much appreciated...

Roberto.. wouldnt it be great to be able to "teach" the image filter what images are spam?, something like bayesian filter. Or in case of a image that keeps getting through, some sort of mechanism that allows the user (admin) to take one of the spams, feed it into the image filter and tell the filter to block mails with this image for nnn days. 0 beeing indefinite.

I think this would help in the fight against image spammers.

We block a good percentage with different src=cid filters in keywords.txt

There is another thread if you do a search.

you run the change of a false positive but I would roughly say that image spam is 40:60 percentage wise now so needs to be blocked.

We tried using regex keywords with src=cid, that definately stopped the spam, however, it seemed to stop an enormous amount of good mail as well (we have found most signatures has src=cid). If it was up to me, I would prefer to get little or no spam, with a few false negatives, however, our clients seem to throw their toys the minute a good email is detected as spam, and on the other hand, they throw their toys when they get a lot of spam.

We recently increased the height and width of images to scan and increased the threshold. This has seemed to stop most of the pump and dump spam, however, there are a few good mails that get filtered. Has anyone found the optimal settings in terms of height, width, sensitivity and threshold?

obviously you have to block very specific src=cid phrases... not just the generic one.

(cid:[\w]{5}\$[\w]{25}\$[\w]{8,15}@[\w!.]{2,18}" somecomment)

we gave up on the image filter, too many times we had the office standard stationary getting blocked.

if there is a way to nicely get some of the image spam by setting it to a bigger height & width that would be great.

We too battled for some time with the pump & dump stocks as well as other image spam.

I can safely say that the image filtering works as long as it is set correctly. It is only a question of tweaking the correct settings in the INI file.

I know logsat wouldn't like to see detailed discussion of the image filter, for fear of spammers lurking here, but I can assure you that it works! last week I got over 1,000 emails which were classified as spam, and got only 3 "pump & dump" into my mail box.

To not block the office stationery check the image size in the INI file.
that was quiet simple to avoid.

Good luck!