[Spambayes] Spam in Images

Tim Peters tim.peters at gmail.com
Thu Aug 3 07:22:26 CEST 2006


[Tim Stone]
> I've got a bit of experience with the PIL, if I get a few spare minutes,
> maybe I'll mess with something.  Can someone send me a typical spam
> image?

I just forwarded to you the most recent pump-&-dump scam I trained on.
 The pitch is in a GIF displaying colored text, and there's a variety
of "visible" gibberish phrases.  It's possible that even cheap palette
histogram analysis could generate "interesting" tokens for these GIFs.
 For example, the GIF in the one I sent is 429x590, but only 7 palette
values are used more than 1000 times:

>>> pprint.pprint(im.getcolors())
[(11631, 0),
 (1829, 1),
 (1104, 2),
 (2584, 3),
 (2525, 4),
 (1, 7),
 (2, 9),
 (1, 15),
 (1, 42),
 (1, 57),
 (1, 65),
 (1, 70),
 (1, 77),
 (1, 78),
 (2, 79),
 (1, 80),
 (2, 82),
 (1, 89),
 (1, 94),
 (2, 99),
 (1, 107),
 (1, 108),
 (1, 113),
 (1, 125),
 (1, 126),
 (1, 129),
 (974, 149),
 (901, 155),
 (1, 156),
 (1, 157),
 (1, 161),
 (1, 165),
 (1, 167),
 (1, 178),
 (1, 183),
 (1, 185),
 (1, 188),
 (1, 192),
 (1, 196),
 (2, 200),
 (1, 205),
 (1, 220),
 (1, 225),
 (1, 228),
 (1, 235),
 (1, 237),
 (1, 240),
 (1, 242),
 (2, 243),
 (1, 244),
 (1, 250),
 (1785, 252),
 (229727, 255)]

I expect that the relatively huge number of palette colors used only
once or twice is something they randomize to prevent exact matches,
and that this is something that doesn't happen in "a real" GIF.

> I don't seem to get them, ever.

Which made me check:  I don't either :-)  By which I mean it appears
that /all/ messages of this kind I've gotten have come via an email
account with a former employer, which they forgot to shut down.  So
there's an obvious way for me to stop getting more of this kind of
spam :-)


More information about the SpamBayes mailing list