RE: [Declude.JunkMail] NOLEGITCONTENT Test

2004-04-09 Thread Markus Gufler

 Would you say that this test is still a valid test? Is it 
 still worth
 -5 when the e-mail does not fail it? If both SPAM and HAM are 
 almost never tripping it perhaps it is a moot point anyway as 
 all mail will have the -5 added to it.

-5 of what? The standard hold weight of 20 points?

In my stats I can see that NOLEGITCONTENT is voting 19% correct for legit
messages. On the other side it has 6% of wrong votes for spam messages. For
the resting 75% of all messages it has no effect on the final weight.

In my eyes compared to other tests it's not the best and not the worst but
still an usefull test (in a weighting system).

Markus

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] NOLEGITCONTENT Test

2004-04-08 Thread R. Scott Perry

Is there a description of what the NOLEGITCONTENT test looks for? It is
adding -5 to a lot of mails and I would like to understand it better.
It looks for information that is rarely ever seen in spam, that appears 
more frequently in legitimate E-mail.  The idea is to help ensure that 
legitimate E-mail gets delivered.  However, it seems that since the test 
was created, more and more spammers have started using portions of real 
legitimate E-mails in their spam (in an attempt to bypass Bayesian 
filtering), which may cause this test to be triggered.

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] NOLEGITCONTENT Test

2004-04-08 Thread Lukasz Kaminski
This test should NOT be used to detect spam! It will be triggered Declude
JunkMail does not detect any legitimate content in an E-mail. Note that a
lot of legitimate E-mail will fail this test, but almost all spam will fail
it. Like the IPNOTINMX test, this test is good for helping reduce false
positives. By default, Declude JunkMail will subtract several points from
the weighting system when an E-mail does not fail this test (which is very
different from the way a spam test normally works).

IPNOTINMX and NOLEGITCONTENT tests are designed to help legitimate E-mail
rather than hurt spam. As a result, E-mails that fail those tests will have
not have any points added to them, but E-mails that do not fail them will
have points subtracted from their total weight.


-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Goran Jovanovic
Sent: Thursday, April 08, 2004 4:34 PM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] NOLEGITCONTENT Test

Hi,

Is there a description of what the NOLEGITCONTENT test looks for? It is
adding -5 to a lot of mails and I would like to understand it better.

Thanx

 
 Goran Jovanovic
 The LAN Shoppe
 2345 Yonge Street, Suite 302
 Toronto, Ontario M4P 2E5
 Phone: (416) 440-1167 x-2113
 Cell: (416) 931-0688
 E-Mail: [EMAIL PROTECTED]
 

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.



---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


Recall: [Declude.JunkMail] NOLEGITCONTENT Test

2004-04-08 Thread Lukasz Kaminski
Lukasz Kaminski would like to recall the message, [Declude.JunkMail]
NOLEGITCONTENT Test.
attachment: winmail.dat

[Declude.JunkMail] NOLEGITCONTENT Test

2004-04-08 Thread Goran Jovanovic
Hi,

Is there a description of what the NOLEGITCONTENT test looks for? It is
adding -5 to a lot of mails and I would like to understand it better.

Thanx

 
 Goran Jovanovic
 The LAN Shoppe
 2345 Yonge Street, Suite 302
 Toronto, Ontario M4P 2E5
 Phone: (416) 440-1167 x-2113
 Cell: (416) 931-0688
 E-Mail: [EMAIL PROTECTED]
 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] NOLEGITCONTENT Test

2004-04-08 Thread Goran Jovanovic
Scott,

Would you say that this test is still a valid test? Is it still worth
-5 when the e-mail does not fail it? If both SPAM and HAM are almost
never tripping it perhaps it is a moot point anyway as all mail will
have the -5 added to it.

 
 Goran Jovanovic
 The LAN Shoppe
 2345 Yonge Street, Suite 302
 Toronto, Ontario M4P 2E5
 Phone: (416) 440-1167 x-2113
 Cell: (416) 931-0688
 E-Mail: [EMAIL PROTECTED]
 
 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Thursday, April 08, 2004 4:48 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] NOLEGITCONTENT Test


Is there a description of what the NOLEGITCONTENT test looks for? It is
adding -5 to a lot of mails and I would like to understand it better.

It looks for information that is rarely ever seen in spam, that appears 
more frequently in legitimate E-mail.  The idea is to help ensure that 
legitimate E-mail gets delivered.  However, it seems that since the test

was created, more and more spammers have started using portions of real 
legitimate E-mails in their spam (in an attempt to bypass Bayesian 
filtering), which may cause this test to be triggered.


-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in
mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.


Re: [Declude.JunkMail] NOLEGITCONTENT Test

2004-04-08 Thread Darin Cox
You're just baiting me to see if I'll go wacko again, aren't you?  SPAM,
HAM...must resist...

From what I've seen, it's still a very useful test for reducing false
positives.

Darin.


- Original Message - 
From: Goran Jovanovic [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Thursday, April 08, 2004 5:11 PM
Subject: RE: [Declude.JunkMail] NOLEGITCONTENT Test


Scott,

Would you say that this test is still a valid test? Is it still worth
-5 when the e-mail does not fail it? If both SPAM and HAM are almost
never tripping it perhaps it is a moot point anyway as all mail will
have the -5 added to it.


 Goran Jovanovic
 The LAN Shoppe
 2345 Yonge Street, Suite 302
 Toronto, Ontario M4P 2E5
 Phone: (416) 440-1167 x-2113
 Cell: (416) 931-0688
 E-Mail: [EMAIL PROTECTED]



-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry
Sent: Thursday, April 08, 2004 4:48 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] NOLEGITCONTENT Test


Is there a description of what the NOLEGITCONTENT test looks for? It is
adding -5 to a lot of mails and I would like to understand it better.

It looks for information that is rarely ever seen in spam, that appears
more frequently in legitimate E-mail.  The idea is to help ensure that
legitimate E-mail gets delivered.  However, it seems that since the test

was created, more and more spammers have started using portions of real
legitimate E-mails in their spam (in an attempt to bypass Bayesian
filtering), which may cause this test to be triggered.


-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in
mailserver
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.