[Rspamd-Users] Image spam

[G.W. Haywood]

Hi there,

On Fri, 9 Sep 2022, K R wrote:

> I get a lot of spam mails, that only contain an image. No other text.
> With Amavis an SA I had a plugin that did OCR to extract the text parts.
>
> Is there anything similar possible with Rspamd?

I'm sure that you *could* do it e.g. with lua

https://rspamd.com/doc/lua/

but I don't know if it's been done specifically with rspamd already.

I've done OCR directly in milters but it does tend to be rather CPU
intensive compared with other ways of flagging the same messages, and
just utilizing the technique itself demands a lot of invested time.
Over the years I've found that the effort involved doesn't justify the
work, and image campaigns rarely last for very long anyway, so I can't
recommend OCR as a spam prevention technique but if you feel compelled
to try it then I can recommend tesseract:

https://en.wikipedia.org/wiki/Tesseract_(software)

I've found that the vast majority of image spam email can be spotted
by means other than OCR which are much more CPU friendly than OCR, for
example you could blacklist or greylist mails with an image attachment
or perhaps only those with an image and no text part:

https://rspamd.com/doc/faq.html#how-to-blacklist-messages-based-on-extension

You could whitelist senders if they do need to send images to you.

It's worth spending some quality time with your favourite search engine,
that's how I found this (with the two-word search string "rspamd OCR":)

https://lists.rspamd.com/pipermail/users/2019-April/000560.html

HTH

-- 

73,
Ged.