I just received some image spam which FUZZY_OCR helped catch. However, the FUZZY_OCR_WRONG_EXTENSION rule triggered when it shouldn't have (if it was attempting to do what I think it was).
Amongst other things, SA reported
1.5 FUZZY_OCR_WRONG_EXTENSION BODY: Mail contains an image with wrong
file extension
Image has format "GIF" but file extension is
"com"
The GIF file was defined by the following MIME component:
--0-1631692137-1169001736=:54847
Content-Type: image/gif
Content-Transfer-Encoding: base64
Content-Id: <3603334256000001@web39602.mail.mud.yahoo.com>
R0lGODdhLgGYAecAAP///+fv/NHj+uLl4Pb3/LbTu4TA7LK68ajX+PL36cbS
As you can see - there is no filename definition. So therefore FUZZY_OCR_WRONG_EXTENSION shouldn't have triggered?
Other than that, FuzzyOCR clicks spam out the door! ;-)
Thanks
Jason