Hello Nick,
Thanks.
That's all good then :-)
_M
Tuesday, June 6, 2006, 10:46:55 AM, you wrote:
>
> Pete McNeil wrote:
>
> Hello Nick,
> What is your false positive rate with that pattern?
>
> Hmm lets go to the MDLP for yesterday :)
>
> SS HH HS SH SA SQ
> REGEX.STOCK.BODY 331 0 0 66 0.667506 0.445565
> COMBO.STOCK_PNG 16 0 0 1 0.882353 0.778547
>
> The regex alone will fp; I score it with a 3 [hold on 10; delete on 24]
> The png combo I just did it last night when I first saw the spam.
> So far I have not see any fp. [ I combo it (the regex) with other
> tests as well - which makes it much more reliable.]
>
> -Nick
>
>
>
>
> _M
> Tuesday, June 6, 2006, 10:05:18 AM, you wrote:
>
>
> Hi Markus -
>
>
>
>
>
> Markus Gufler wrote:
>
>
>
>
>
>
> There is also another type of spam (stock spam now with attached png image)
> this morning passing our filters.
>
>
> I am catching these fairly easily -
> a combo filter -
> #combo-stockspammer-png.txt
> SKIPIFWEIGHT 26
> TESTSFAILED END NOTCONTAINS EXTERNAL.REGEX.STOCKSPAMMER.BODY
> BODY 5 CONTAINS Content-Type: image/png;
> #
> The body regex is this:
> src="cid:[a-z0-9]{12}\$[a-z0-9]{8}\$[a-z0-9]{8}@
>
>
>
>
>
> -Nick
>
>
>
>
>
>
>
>
>
>
>
>
>
> #############################################################
> This message is sent to you because you are subscribed to
> the mailing list <sniffer@sortmonster.com>.
> To unsubscribe, E-mail to: <[EMAIL PROTECTED]>To switch
> to the DIGEST mode, E-mail to <[EMAIL PROTECTED]>To
> switch to the INDEX mode, E-mail to
> <[EMAIL PROTECTED]>Send administrative queries to
> <[EMAIL PROTECTED]>
>
>
>
>
>
>
--
Pete McNeil
Chief Scientist,
Arm Research Labs, LLC.
#############################################################
This message is sent to you because you are subscribed to
the mailing list <sniffer@sortmonster.com>.
To unsubscribe, E-mail to: <[EMAIL PROTECTED]>
To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]>
To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]>
Send administrative queries to <[EMAIL PROTECTED]>
