do you know ImageCerberusPLG4 ?

Report bugs and workarounds
Post Reply
knarou
Posts: 4
Joined: 18 Aug 2014 09:00

do you know ImageCerberusPLG4 ?

Post by knarou »

Hello everybody,

do you know the rules ImageCerberusPLG4 in mailscanner spamassasin ?
Beacause sometime, when local user send mail , it go directely in spam with this rules.

Spam Report:
Score Matching Rule Description
-1.00 ALL_TRUSTED
-1.90 BAYES_00
0.00 HTML_MESSAGE
4.00 ImageCerberusPLG4
1.90 MISSING_MIMEOLE
1.51 SUBJ_ALL_CAPS
2.17 TVD_RCVD_SINGLE
0.00 URIBL_BLOCKED
1.51 URIBL_RHS_DOB

Thanks in advance.

Have a nice day
K
User avatar
shawniverson
Posts: 3644
Joined: 13 Jan 2014 23:30
Location: Indianapolis, Indiana USA
Contact:

Re: do you know ImageCerberusPLG4 ?

Post by shawniverson »

Is there an image attached to the email? Perhaps a picture in the signature line?

I have had the rule fire off on rare occasions from such pictures.
ssheikh
Posts: 1
Joined: 05 Nov 2014 07:11

Re: do you know ImageCerberusPLG4 ?

Post by ssheikh »

Same problem here. I have this fire off 90% of the time with a score of 4 with one company that we regularly exchange e-mails with. It causes a fair amount of e-mails from them to get flagged as possible spam.

They have Twitter, LinkedIn, YouTube, etc icons as part of their standardized signature. Amongst those icons, there also what appears to be a 75 x 75 pixel just blank off-white tile in the form of a few byte jpeg file. The lowest common denominator I have found is that jpeg file triggers ImageCerberusPLG4 with a score of 4.

I have looked through several hundred actual spam messages and none of them were trapped as a result of ImageCerberusPLG4. Yet on a daily basis I get more than 15 messages that get falsely flagged as possible spam because of ImageCerberusPLG4. And the end-users routinely have problems in releasing those messages (which is a different problem I am troubleshooting).

Looking for a way to turn it off and keep it off through upgrades.

Thanks,

Shahid
User avatar
shawniverson
Posts: 3644
Joined: 13 Jan 2014 23:30
Location: Indianapolis, Indiana USA
Contact:

Re: do you know ImageCerberusPLG4 ?

Post by shawniverson »

You can add a spamassassin rule to local.cf to override this score...
Matthew
Posts: 9
Joined: 03 Dec 2014 22:13

Re: do you know ImageCerberusPLG4 ?

Post by Matthew »

Hi All
I need to do some massaging of the Spam assassin scores to save ourselves time
I have tried editing the local.cf and this is not appearing to work
Therefore I am the issue

Is there any more info on how this Spam assassin is implemented that I can work with?
For example the rules go in the shortcircuit zone or before this etc

One reason I am having is this fc file is effectively empty and all rules are hashed out
The only rule not hashed is the if / end if for the shortcircuit

thanks in advance
User avatar
shawniverson
Posts: 3644
Joined: 13 Jan 2014 23:30
Location: Indianapolis, Indiana USA
Contact:

Re: do you know ImageCerberusPLG4 ?

Post by shawniverson »

Correct, in the cast of ImageCerberusPLG4, you would add the following to local.cf:

Code: Select all

score     ImageCerberusPLG4     1.0  1.0  1.0  1.0
I changed it to 1 from 4 in this example.
User avatar
pdwalker
Posts: 1553
Joined: 18 Mar 2015 09:16

customizing spamassassin scores: local.cf

Post by pdwalker »

shawniverson wrote:You can add a spamassassin rule to local.cf to override this score...
being pendantic; the file is in:
/etc/mail/spamassassin/local.cf
Question: do we need to restart spamassassin after changing the rules?
User avatar
darky83
Site Admin
Posts: 540
Joined: 30 Sep 2012 11:03
Location: eFa
Contact:

Re: do you know ImageCerberusPLG4 ?

Post by darky83 »

Not sure, don't think it is needed.

spamassassin is invoked by mailscanner at each mail, so guessing that the config is re-read everytime.
But might be that the config is cached somewhere, so if it is not working just reload the MailScanner service.
Version eFa 4.x now available!
toddh
Posts: 69
Joined: 16 Feb 2015 18:52

Re: do you know ImageCerberusPLG4 ?

Post by toddh »

Realize this is an old thread but we had this happen today, email block by ImageCerberusPLG4.

It was a .gif that was only a small white rectangle.

Added the exception to local.cf and all is good.

Thanks!


-
Post Reply