Re: [Declude.JunkMail] How do you use NOLEGITCONTENT and IPNOTINMX

[Pete McNeil]

On 4/8/2011 3:49 PM, IMail Admin wrote: <snip/> For example, I weight Sniffer at 8, so I get a lot of spam that score 8.  They’re true spam, but the other tests don’t confirm it and my delete threshold is 12 (although I would be happy to get just to 10 on these spams).  One way you might get there (part of the time anyway) -- The OEM version of SNF in Declude exposes the IP reputation component. If you add weigh based on the IP reputation and consider that as an additional test, then you will be able to hold/delete some spam with just two results from SNF. Consider that if SNF finds a pattern match it will generate a result other than 20, 40, or 63. So, if you get a result of, say, 57 - and you also have an IP reputation that is sufficiently bad, then you would be able to consider those two "tests" as independent and so you should be able to score them so that you hold/delete the spam. When SNF returns a pattern match result - the IP reputation component is trained, but does not itself have any bearing on the result that is returned. When the IP reputation (GBUdb) component of SNF does have a bearing on the result the pattern engine component does not and those results are 20, 40, or 63. Hope this helps, _M -- Pete McNeil, President MicroNeil Research Corporation www.microneil.com 703.779.4909 x7010 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.