A few months ago, SpamOnion started a new procedure to improve upon its ability to detect and block email based phishing attacks and various scams. The results have been fantastic. In the past 30 days, we have blocked over 500,000 phishing attacks, scams and image based scams.

SpamOnion already makes use of the ClamAV anti-virus software to detect and block known viruses and other malware. Recently, the good people at SaneSecurity (unaffiliated with SaNE, Inc) started providing signatures that detect known phishing attacks and other scams... In January 2007 we put them into full production and so far have had zero false positives. Besides stopping many malicious phishing attacks, we have also increased our ability to block many image based attacks which are notoriously hard to detect.

Our company has been using your signatures on our Gateway for a little over a week now. Wow Man, Bravo! Perfect solution to the PDF Spam Nightmare. If you would like to be mentioned on our site, please say so,
I will be happy to add you. We will also be donating to you in the near future. Keep up the good work!

This morning we had everything but the kitchen sink thrown at us. Those sanesecurity definitions blocked several hundred messages in 14 minutes, and most of them were .pdf image spam messages. Without those definitions I'm sure most, if not all of them would have made it through.

This, together with the addition of the SaneSecurity signatures for ClamAV,
has made a huge difference to the amount of spam now entering our mailboxes

We have increased the effectiveness of the spam filtering system by adding the SaneSecurity ClamAV Phishing and Scam signatures. This also blocks much of the PDF spam that has recently become so prevalent. We are keeping an eye on this to ensure there are no false positives, but the results so far are very encouraging.

I have to mention how pleased we are with the sanesecurity clamav tool. We have always used spamassassin with many custom rule sets, dcc and rbls, with clamd for virus scanning.

We have been getting a large number (~4,500 per day) of these PDF and other attachment spams making it through SA, even with PDFinfo and everything else we could throw at them. After adding the sanesecurity sigs to clamd last
week not one PDF has made it through. And since clamd unpacks and examines every attachment anyway it is no additional load. In fact, due to the messages not hitting SA it probably reduced load slightly.

I just installed them yesterday. Had been meaning to for a while, but things have been too busy to get the script written to update them. So, in less than 24 hours, hit over 1800 spam messages here-- about 1/3 of our spam volume.

I just installed it and it's catching about one spam a second. I highly recommend this

jI discovered your ClamAV signatures a week or two ago, and I just had to write to you to tell you they're the best thing I've found in a long time. They've cut my spam load by 90%. Thank you for the work you put into maintaining them!

MailWash has incorporated the phish / scam signature sets from Sane Security which provide real time checking of thousands of known active phishing / scam sites.

The Sane Security signature sets incorporate user contributed active phishing sites as well as verified sites from phishery.internetdefence.net. The inclusion of these signature sets ensures even more effective protection against malicous content emails from ending up in your mailbox or corporate network.

The real success story here has been to use Sanesecurity's anti-phishing and anti-scam databases with the ClamAV virus checker.

Thanks so much for your signatures, they have cut down phishing/scam
emails tremendously

In addition to (or maybe even instead of) FuzzyOCR, you should also consider using some of the add-on clamav spam/phish signature databases.

In particular I have found the sanesecurity lists to be extremely effective.

It also shows that Steve's lists from Sane Security are continuing to kick some serious butt. Thanks again, Steve!

Thanks again for an excellent resource.

..Your signatures have made a great number of our clients extremely happy..We aren’t looking for thanks or advertising, just to ensure you keep doing what you are doing, as it greatly benefits our servers and users, it is amazing watching the tracking scripts tell us what you filter out so easily