RE: Re[2]: [Declude.JunkMail] "Nigerian" Filter Creator Helper
Does the junkmail fire redirect work for aliased domains. It origionally did not. For example I have an alias setup as [EMAIL PROTECTED] and that points to [EMAIL PROTECTED] and I put REDIRECT @mail.internal d:\junkmailfiles\strict.junkmail In the $default$.junkmail file will it use the redirect file or use the settings in the $default$.junkmail. In this case, Declude JunkMail should use the d:\junkmailfiles\strict.junkmail file. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
RE: Re[2]: [Declude.JunkMail] "Nigerian" Filter Creator Helper
Does the junkmail fire redirect work for aliased domains. It origionally did not. For example I have an alias setup as [EMAIL PROTECTED] and that points to [EMAIL PROTECTED] and I put REDIRECT @mail.internal d:\junkmailfiles\strict.junkmail In the $default$.junkmail file will it use the redirect file or use the settings in the $default$.junkmail. Kevin Bilbee > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Glenn \\ WCNet > Sent: Friday, January 23, 2004 12:04 PM > To: [EMAIL PROTECTED] > Subject: Re: Re[2]: [Declude.JunkMail] "Nigerian" Filter Creator Helper > > > Hmmm. I tag the subject on weight 14 to 19, delete on 20+. I've had > Sniffer weighted at 18 for a while. Reduced it to 16 a couple days ago > after adding some additional SORBS tests that are in the lastest > global.cfg. > Anyway, I've had several Nigerian-type scam emails come through without > failing ANY tests. > > Glenn Z. > > > - Original Message - > From: "Madscientist" <[EMAIL PROTECTED]> > To: "Kevin Bilbee" <[EMAIL PROTECTED]> > Sent: Friday, January 23, 2004 12:15 PM > Subject: Re[2]: [Declude.JunkMail] "Nigerian" Filter Creator Helper > > > > Hello Kevin, > > > > Friday, January 23, 2004, 12:37:37 PM, you wrote: > > > > KB> I have been testing Kami's Nigerian filter and found that > in 3 days it > > KB> flagged 56 email and only caught out of 5 nigerian scam emails. > > > > KB> I do not see this as a fault of Kami's effort but a fault of > filtering. Some > > KB> of the line are very common in ligitimate email. I even lowered all > the > > KB> weights to match our weighting scores. We will not be using > it. Once I > did > > KB> that then the nigerian scam email did not get enough weight to be > flagged > > KB> properly. > > > > KB> For the effort it is not worth the results, in my opinion. > > > > Sniffer has a number of rules for nigerian scam email. So far we've > > never had a reported false positive for one of those rules. Perhaps > > the reason is that we can provide more complex filtering matching > > combinations of phrases from different segments of the message. > > > > _M > > __ > > Peter G McNeil (Madscientist, CodeDweller) > > President, MicroNeil Research Corporation. > > Chief SortMonster, www.SortMonster.com > > > > --- > > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
Re: Re[2]: [Declude.JunkMail] "Nigerian" Filter Creator Helper
Hmmm. I tag the subject on weight 14 to 19, delete on 20+. I've had Sniffer weighted at 18 for a while. Reduced it to 16 a couple days ago after adding some additional SORBS tests that are in the lastest global.cfg. Anyway, I've had several Nigerian-type scam emails come through without failing ANY tests. Glenn Z. - Original Message - From: "Madscientist" <[EMAIL PROTECTED]> To: "Kevin Bilbee" <[EMAIL PROTECTED]> Sent: Friday, January 23, 2004 12:15 PM Subject: Re[2]: [Declude.JunkMail] "Nigerian" Filter Creator Helper > Hello Kevin, > > Friday, January 23, 2004, 12:37:37 PM, you wrote: > > KB> I have been testing Kami's Nigerian filter and found that in 3 days it > KB> flagged 56 email and only caught out of 5 nigerian scam emails. > > KB> I do not see this as a fault of Kami's effort but a fault of filtering. Some > KB> of the line are very common in ligitimate email. I even lowered all the > KB> weights to match our weighting scores. We will not be using it. Once I did > KB> that then the nigerian scam email did not get enough weight to be flagged > KB> properly. > > KB> For the effort it is not worth the results, in my opinion. > > Sniffer has a number of rules for nigerian scam email. So far we've > never had a reported false positive for one of those rules. Perhaps > the reason is that we can provide more complex filtering matching > combinations of phrases from different segments of the message. > > _M > __ > Peter G McNeil (Madscientist, CodeDweller) > President, MicroNeil Research Corporation. > Chief SortMonster, www.SortMonster.com > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
