One observation I have made is majority of such spam come from random emails but the content refers to certain web sites - quite consistently.
So we have an active URL list that if found in the body of emails it will weigh them quite high. These URL's are real consistent and in combination of subject filters we have blocked pretty much all of them. Two combination we have used for filter. 1: If the body is BASE64 and the email is coming from a free email then the weight is automatically a hold. 2: If certain URL's are listed in the body then they are hold 3: If subject also has certain words then it gets weighted accordingly. We have also made it such that the words like viagra if spelled with v*agra receive a higher weight than the actual word. With 3 filter files we have done this quite effectively: 1- subject filter file 2- body filter file 3- bodyURL filter file 4- free eMail from file Of course we complement this with our blacklist file and Tom's blacklist file. Our blacklist is deleted and Tom's blacklist gets hold action for review. Regards, Kami -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of John Tolmachoff Sent: Tuesday, January 14, 2003 10:54 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Filter Questions/Suggestions I am using a combination of adult senders list, simple filters and NoXMail. The use of filters can be hard do to the mix/combination of words. Plus, the senders themselves are smart, such as one sender that kept sending with the word f * c k in the subject line, with out the spaces. Any one reading that knows what it means, but a filter will not catch it. It is not easy to always catch these, and it has taken me months do get the right balance, (knock on wood,) so as to catch over 90% with few FP. John Tolmachoff MCSE, CSSA IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
