Inspired by complaints about all-image or mostly-image spam that's
getting by SA, I've cooked up three sets of rules that analyze the use
of IMG tags in HTML: one that looks at the total area of all of the
images in the message (T_HTML_IMAGE_AREA*), one that looks at the
total number of images in the message (T_HTML_NUM_IMGS*), and one that
looks at the longest total run of consecutive images
The total area of all images is rather easy to compute: inside of
HTML::html_tests(), if an IMG tag has both the width and height
properties, then multiply them together and add the result to the
Spam % of all rules with S/0 > 0.90: 20.615%
The total number of IMG tags is really easy to do.
Spam % of all rules with S/O > 0.90: 31.25%
I figured that spam that is made up of only images is going to only
have IMG tags interspersed with table, paragraph and linebreak tags,
and some whitespace, so there would be a lot of IMG tags with no plain
text (non-whitespace) between them.  So I defined consecutive IMG tags
to be ones with no text between them, and looked at the longest run of
This one seems to do pretty good, because in my non-spam corpus
there's only a handful of messages with IMG runs larger than two.
Spam % of all rules with S/O > 0.90: 22.85%
Next I'm going to see if there's any meta rules I can make that will

No, hits=-40.0 required=5.0
	tests=AWL,BUGZILLA_BUG,DISCLAIMER,KNOWN_MAILING_LIST,
	      NO_REAL_NAME,T_NONSENSE_FROM_00_10
	version=2.50-cvs

by example.com (Postfix, from userid 500)
	id 6038A16F03; Sat,  5 Oct 2002 18:17:58 +0100 (IST)
from example.com (localhost [127.0.0.1])
	by jmason.org (Postfix) with ESMTP
	id 4CA2BF7B1; Sat,  5 Oct 2002 18:17:58 +0100 (IST)
yyyy@example.com (Justin Mason),
	spamassassin list <spamassassin-talk@lists.sourceforge.net>
No, hits=-19.8 required=5.0
	tests=AWL,HABEAS_SWE,IN_REP_TO,QUOTED_EMAIL_TEXT,
	      T_NONSENSE_FROM_00_10
	version=2.50-cvs

No, hits=1.3 required=5.0
	tests=KNOWN_MAILING_LIST,TO_HAS_SPACES,T_NONSENSE_FROM_30_40
	version=2.50-cvs

from localhost (localhost [127.0.0.1])
	by phobos.labs.netnoteinc.com (Postfix) with ESMTP id 6B14047C66
	for <jm@localhost>; Thu, 22 Aug 2002 11:06:53 -0400 (EDT)
from phobos [127.0.0.1]
	by localhost with IMAP (fetchmail-5.9.0)
	for jm@localhost (single-drop); Thu, 22 Aug 2002 16:06:53 +0100 (IST)
from usw-sf-list2.sourceforge.net (usw-sf-fw2.sourceforge.net
    [216.136.171.252]) by dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id
    g7MF4sZ11366 for <jm@jmason.org>; Thu, 22 Aug 2002 16:04:54 +0100
No, hits=-3.3 required=7.0
	tests=FOR_FREE,KNOWN_MAILING_LIST,SPAM_PHRASE_05_08,USER_AGENT,
	      X_ACCEPT_LANG
	version=2.40-cvs