Alright, so... I think an update to the IMail user guide is in order. That section needs to be a little more descriptive. I'd throw in something like this-- anyone else have any other suggestions?
PHRASELIST NORMALIZED PHRASELIST EMAIL NORMALIZED EML ----------- --------------------- ----- --------------- mort.gage mortgage mort.gage mortgage (phrase list match) mort.gage mortgage mortgage mortgage (phrase list match) m0rtgage mrtgage [EMAIL PROTECTED] mrtgage (phrase list match) f.r.e.e. free f;r;e;e; free (phrase list match) m0rtgage mrtgage mortgage mortgage (phrase list DOES NOT match) So, you can only safely add words to the phrase list that have SUBSTITUTED characters and not catch legit mail... adding words with EXTRA non-alpha characters can result in false positives when normalization is enabled. ---------- Original Message ---------------------------------- From: "Tripp Allen" <[EMAIL PROTECTED]> Reply-To: [EMAIL PROTECTED] Date: Wed, 5 May 2004 12:30:04 -0400 When normalizing is turned on, but the phrase list and email are normalized. Mor'tgage and mor.tgage will both be normalized to mortgage. Tripp ----- Original Message ----- From: "Spaminator " <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, May 05, 2004 12:24 PM Subject: [IMail Forum] Phrase Filter Malfunction?? I apologize for posting this twice to the list in a week, but this is a big issue. Last week I realized that the new 8.1 phrase filtering was catching all emails with the word "mortgage" in them, despite the fact there was no "mortgage" in the phrase list (although it appears as part of larger phrases, like "free mortgage consultation"). This was a critical problem, as one of our clients is a mortgage company. Following someone's advice, I rolled back to using the stock Ipswitch anti-spam config files... the problem seemed to go away. Now it's happening again. I noticed the following in the phrase list (we added them yesterday): Mor'tgage mor.tgage m0rtgage These three phrases are being matched successfully against "mortgage" for some reason. Maybe I'm totally wrong, but I *thought* that words in the phrase list were untouched-- that they were compared to the "normalized" words in the incoming email. Here's the text from the IPSwitch user guide: Normalize Words. If this option is selected, IMail strips out all non-alphabetic characters (anything other than A-Z, a-z) from words before comparing them to the phrase list. This clearly implies that it's the text of the EMAIL that's normalized, not the phrase list. Otherwise, how can we ever hope to filter out emails like mor.tgage without catching legit emails? See the spam log entries below-- it's clearly matching "mortgage": 05:05 08:50 SMTP(f142075b00d006e7) Got Content Filter for mail.xxxxxxxxx.com 05:05 08:50 SMTP(f142075b00d006e7) scanning the subject for phrases 05:05 08:50 SMTP(f142075b00d006e7) scanning the body for phrases 05:05 08:50 SMTP(f142075b00d006e7) matched phrase [mortgage] Is anyone else observing the same phenomenon?? Am I totally misunderstanding how the normalize words feature is supposed to work? Thanks, Brett To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
