Re: AW: [Declude.JunkMail] Bogus comments

[DLAnalyzer Support]

Michael, 

You would set this up like any of your other non RBL tests 

COMMENTS	comments	5	x	3	0 

The first number is the number of comments.  As with all of the other tests 
the 3 is the weight assigned. 

With having it set at five comments only a small handful of messages fail 
this test for us(see below about 2.5% out of 700K+ Messages).  Not to 
mention I have never seen a false positive up to this point that actually 
failed the comments test so I beleive 5 is a safe number, but I would love 
to hear others settings. 

DLAnalyzer(v1.9.1R) Report Generated At 9/2/2003 11:53:31 PM For Invariant 
Systems
Report Start Time: 8/1/2003 12:00:00 AM
Report End Time: 8/31/2003 12:00:00 AM
Total Messages: 711,408
Messages That Failed: 583,732
Spam Percentage: 82.05% 

TEST  # FAILED   Percentage
COMMENTS18,1002.54% 

Darrell
---
Check out DLAnalyzer a comprehensive reporting tool for
Declude Junkmail Logs - http://www.dlanalyzer.com 

interactiveaustria writes: 

Hi, 

 is there a possibility to test for (bogus) comments with
 Declude.Junkmail (I'm using the lite version)? Something like 

As I know JM has a COMMENTS test from v1.67beta on. 

Is it an undocumented feature? I can't find anything in the manual... How do
I setup this? 

Best wishes
Michael
+--+
| interactiveaustria   |
| Michael Tobisch EDV-Dienstleistungen |
| Wiesengasse 12, A-8160 Weiz  |
| Tel +43 3172 4930|
| GSM +43 664 2126941  |
| EMail [EMAIL PROTECTED]|
| Web http://www.iaa.at|
+--+
| Kundeninformationen per E-Mail:  |
| http://www.iaa.at/kundeninfo.asp |
+--+ 

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] 

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

Re: AW: [Declude.JunkMail] Bogus comments

[R. Scott Perry]

Not to mention I have never seen a false positive up to this point that 
actually failed the comments test so I beleive 5 is a safe number, but I 
would love to hear others settings.
FWIW, we haven't heard of a single false positive even at 1.  While a fair 
amount of legitimate bulk HTML E-mail has comments in it (I can't say 
*why*, but they do), the COMMENTS test in Declude JunkMail will only get 
triggered with anti-filter comments.  So if you have:

!-- The next line is the recipient's name --
Dear Joe Smith,
Thanks for placing an order for B!-- product name comes next 
--Widgets/B from us!

the COMMENTS test wouldn't see any anti-filter comments.  However:

If you place an or!--spriw--der in the next 10 days...

then it would trigger the COMMENTS test.  However, I'm not aware of any 
spams that contained less than 5 anti-filter comments (most contain a *lot*).

   -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.