Hmmm. I tag the subject on weight 14 to 19, delete on 20+. I've had Sniffer weighted at 18 for a while. Reduced it to 16 a couple days ago after adding some additional SORBS tests that are in the lastest global.cfg. Anyway, I've had several Nigerian-type scam emails come through without failing ANY tests.
Glenn Z. ----- Original Message ----- From: "Madscientist" <[EMAIL PROTECTED]> To: "Kevin Bilbee" <[EMAIL PROTECTED]> Sent: Friday, January 23, 2004 12:15 PM Subject: Re[2]: [Declude.JunkMail] "Nigerian" Filter Creator Helper > Hello Kevin, > > Friday, January 23, 2004, 12:37:37 PM, you wrote: > > KB> I have been testing Kami's Nigerian filter and found that in 3 days it > KB> flagged 56 email and only caught out of 5 nigerian scam emails. > > KB> I do not see this as a fault of Kami's effort but a fault of filtering. Some > KB> of the line are very common in ligitimate email. I even lowered all the > KB> weights to match our weighting scores. We will not be using it. Once I did > KB> that then the nigerian scam email did not get enough weight to be flagged > KB> properly. > > KB> For the effort it is not worth the results, in my opinion. > > Sniffer has a number of rules for nigerian scam email. So far we've > never had a reported false positive for one of those rules. Perhaps > the reason is that we can provide more complex filtering matching > combinations of phrases from different segments of the message. > > _M > __________________________________________ > Peter G McNeil (Madscientist, CodeDweller) > President, MicroNeil Research Corporation. > Chief SortMonster, www.SortMonster.com > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
