RE: [Declude.JunkMail] Nigerian Filter Creator Helper
Why not use Kami's Nigerian Filter? He's done all of the work for you. Just remember to thank him. That sounds interesting, how about a pointer to Kami's site/email/etc.? (Or am I just too far out of it and missed the obvious location somehwere...?) Thanks, and in advance, thanks to Kami and everyone who has created a filter which I might ever use or use for inspiration. Jeff -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Wednesday, December 31, 2003 12:15 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Nigerian Filter Creator Helper Hello, All, I'm looking for a type of utility that either specifically was written to do what I describe below or a utility which is a broad-based text massaging/manipulation utility which could be twisted to do the following. I would like a utility that I could feed the bodies of nigerian scam letters into and it would basically create a list of all phrases of world length X to Y where X and Y are both numbers. It would capture information from each scam letter that I feed in and would generate an ordered list of each time the X to Y word length phrase appears in each letter. So, for example, if my X and Y were 3 and 5 it would generate a list of all 3 word, 4 word and 5 word phrases found in each message. Then it would add 1 to the tally of each time this phrase is found in any given unique nigerian scam letter. After I submit a certain letters, e.g. 20 (?), I would have a list of very commonly found phrases in Nigerian scam letters. I could then create a custom filter for DJM based on those phrases. Ultimately my filter might look something like... # JunkMail.Filter.Nigerian.txt BODY 10 CONTAINS Nigerian Federal Ministry BODY 10 CONTAINS prayed for ALLAHS devine mercies BODY 10 CONTAINS shores of Nigeria BODY 10 CONTAINS we solicit for your I was hoping that their might be a small utility that some of the Nigerian scam fighting organizations had released to generate keyphrase lists. Does this sound like a decent idea? Are there any good utilities to do this? Or is this something I'd have to write myself? Would it be prohibitively complicated to write a program like this for a person who hasn't done much programming? Or is this pretty straightforward? Thanks In Advance, Dan -- - Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Nigerian Filter Creator Helper
I have been testing Kami's Nigerian filter and found that in 3 days it flagged 56 email and only caught out of 5 nigerian scam emails. I do not see this as a fault of Kami's effort but a fault of filtering. Some of the line are very common in ligitimate email. I even lowered all the weights to match our weighting scores. We will not be using it. Once I did that then the nigerian scam email did not get enough weight to be flagged properly. For the effort it is not worth the results, in my opinion. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of [EMAIL PROTECTED] Sent: Friday, January 23, 2004 7:59 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Nigerian Filter Creator Helper Why not use Kami's Nigerian Filter? He's done all of the work for you. Just remember to thank him. That sounds interesting, how about a pointer to Kami's site/email/etc.? (Or am I just too far out of it and missed the obvious location somehwere...?) Thanks, and in advance, thanks to Kami and everyone who has created a filter which I might ever use or use for inspiration. Jeff -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Wednesday, December 31, 2003 12:15 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Nigerian Filter Creator Helper Hello, All, I'm looking for a type of utility that either specifically was written to do what I describe below or a utility which is a broad-based text massaging/manipulation utility which could be twisted to do the following. I would like a utility that I could feed the bodies of nigerian scam letters into and it would basically create a list of all phrases of world length X to Y where X and Y are both numbers. It would capture information from each scam letter that I feed in and would generate an ordered list of each time the X to Y word length phrase appears in each letter. So, for example, if my X and Y were 3 and 5 it would generate a list of all 3 word, 4 word and 5 word phrases found in each message. Then it would add 1 to the tally of each time this phrase is found in any given unique nigerian scam letter. After I submit a certain letters, e.g. 20 (?), I would have a list of very commonly found phrases in Nigerian scam letters. I could then create a custom filter for DJM based on those phrases. Ultimately my filter might look something like... # JunkMail.Filter.Nigerian.txt BODY 10 CONTAINS Nigerian Federal Ministry BODY 10 CONTAINS prayed for ALLAHS devine mercies BODY 10 CONTAINS shores of Nigeria BODY 10 CONTAINS we solicit for your I was hoping that their might be a small utility that some of the Nigerian scam fighting organizations had released to generate keyphrase lists. Does this sound like a decent idea? Are there any good utilities to do this? Or is this something I'd have to write myself? Would it be prohibitively complicated to write a program like this for a person who hasn't done much programming? Or is this pretty straightforward? Thanks In Advance, Dan -- - Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Nigerian Filter Creator Helper
Interesting, in my testing it has only produced 3 FP, and those would not have been held except that they had other problems as well. As has been said, you mileage may vary. John Tolmachoff Engineer/Consultant/Owner eServices For You -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Kevin Bilbee Sent: Friday, January 23, 2004 9:38 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Nigerian Filter Creator Helper I have been testing Kami's Nigerian filter and found that in 3 days it flagged 56 email and only caught out of 5 nigerian scam emails. I do not see this as a fault of Kami's effort but a fault of filtering. Some of the line are very common in ligitimate email. I even lowered all the weights to match our weighting scores. We will not be using it. Once I did that then the nigerian scam email did not get enough weight to be flagged properly. For the effort it is not worth the results, in my opinion. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of [EMAIL PROTECTED] Sent: Friday, January 23, 2004 7:59 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Nigerian Filter Creator Helper Why not use Kami's Nigerian Filter? He's done all of the work for you. Just remember to thank him. That sounds interesting, how about a pointer to Kami's site/email/etc.? (Or am I just too far out of it and missed the obvious location somehwere...?) Thanks, and in advance, thanks to Kami and everyone who has created a filter which I might ever use or use for inspiration. Jeff -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Wednesday, December 31, 2003 12:15 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Nigerian Filter Creator Helper Hello, All, I'm looking for a type of utility that either specifically was written to do what I describe below or a utility which is a broad-based text massaging/manipulation utility which could be twisted to do the following. I would like a utility that I could feed the bodies of nigerian scam letters into and it would basically create a list of all phrases of world length X to Y where X and Y are both numbers. It would capture information from each scam letter that I feed in and would generate an ordered list of each time the X to Y word length phrase appears in each letter. So, for example, if my X and Y were 3 and 5 it would generate a list of all 3 word, 4 word and 5 word phrases found in each message. Then it would add 1 to the tally of each time this phrase is found in any given unique nigerian scam letter. After I submit a certain letters, e.g. 20 (?), I would have a list of very commonly found phrases in Nigerian scam letters. I could then create a custom filter for DJM based on those phrases. Ultimately my filter might look something like... # JunkMail.Filter.Nigerian.txt BODY 10 CONTAINS Nigerian Federal Ministry BODY 10 CONTAINS prayed for ALLAHS devine mercies BODY 10 CONTAINS shores of Nigeria BODY 10 CONTAINS we solicit for your I was hoping that their might be a small utility that some of the Nigerian scam fighting organizations had released to generate keyphrase lists. Does this sound like a decent idea? Are there any good utilities to do this? Or is this something I'd have to write myself? Would it be prohibitively complicated to write a program like this for a person who hasn't done much programming? Or is this pretty straightforward? Thanks In Advance, Dan -- - Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail
RE: [Declude.JunkMail] Nigerian Filter Creator Helper
Correction: That should be only caught 2 out of 5 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Kevin Bilbee Sent: Friday, January 23, 2004 9:38 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Nigerian Filter Creator Helper I have been testing Kami's Nigerian filter and found that in 3 days it flagged 56 email and only caught out of 5 nigerian scam emails. I do not see this as a fault of Kami's effort but a fault of filtering. Some of the line are very common in ligitimate email. I even lowered all the weights to match our weighting scores. We will not be using it. Once I did that then the nigerian scam email did not get enough weight to be flagged properly. For the effort it is not worth the results, in my opinion. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of [EMAIL PROTECTED] Sent: Friday, January 23, 2004 7:59 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Nigerian Filter Creator Helper Why not use Kami's Nigerian Filter? He's done all of the work for you. Just remember to thank him. That sounds interesting, how about a pointer to Kami's site/email/etc.? (Or am I just too far out of it and missed the obvious location somehwere...?) Thanks, and in advance, thanks to Kami and everyone who has created a filter which I might ever use or use for inspiration. Jeff -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Wednesday, December 31, 2003 12:15 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Nigerian Filter Creator Helper Hello, All, I'm looking for a type of utility that either specifically was written to do what I describe below or a utility which is a broad-based text massaging/manipulation utility which could be twisted to do the following. I would like a utility that I could feed the bodies of nigerian scam letters into and it would basically create a list of all phrases of world length X to Y where X and Y are both numbers. It would capture information from each scam letter that I feed in and would generate an ordered list of each time the X to Y word length phrase appears in each letter. So, for example, if my X and Y were 3 and 5 it would generate a list of all 3 word, 4 word and 5 word phrases found in each message. Then it would add 1 to the tally of each time this phrase is found in any given unique nigerian scam letter. After I submit a certain letters, e.g. 20 (?), I would have a list of very commonly found phrases in Nigerian scam letters. I could then create a custom filter for DJM based on those phrases. Ultimately my filter might look something like... # JunkMail.Filter.Nigerian.txt BODY 10 CONTAINS Nigerian Federal Ministry BODY 10 CONTAINS prayed for ALLAHS devine mercies BODY 10 CONTAINS shores of Nigeria BODY 10 CONTAINS we solicit for your I was hoping that their might be a small utility that some of the Nigerian scam fighting organizations had released to generate keyphrase lists. Does this sound like a decent idea? Are there any good utilities to do this? Or is this something I'd have to write myself? Would it be prohibitively complicated to write a program like this for a person who hasn't done much programming? Or is this pretty straightforward? Thanks In Advance, Dan -- - Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned
Re: [Declude.JunkMail] Nigerian Filter Creator Helper
Matt, this filter won't get run unless an E-mail gets past almost everything else with a score less than 28 on my system How are you accomplishing that? Are you uising SKIPIFWEIGHT on the filter? -Dave
Re: [Declude.JunkMail] Nigerian Filter Creator Helper
Kevin, I also have been using Kami's Nigerian stuff, however I modified it a great deal and removed some of the lines that I felt were too common, I reduced scores, and capped the score at 80% of my hold weight. The result is that it only hit 0.06% of my total mail volume across a 3 day period earlier this week, however this filter won't get run unless an E-mail gets past almost everything else with a score less than 28 on my system, which is about 85% on average. I feel that this is working correctly, and it does score some things that are very hard to catch with other filters. Sniffer also does a good job with this stuff, so between the two, I think I'm pretty well protected. Attached is a copy of Kami's filter that was modified as described above. I think this may improve your results. Matt Kevin Bilbee wrote: I have been testing Kami's Nigerian filter and found that in 3 days it flagged 56 email and only caught out of 5 nigerian scam emails. I do not see this as a fault of Kami's effort but a fault of filtering. Some of the line are very common in ligitimate email. I even lowered all the weights to match our weighting scores. We will not be using it. Once I did that then the nigerian scam email did not get enough weight to be flagged properly. For the effort it is not worth the results, in my opinion. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of [EMAIL PROTECTED] Sent: Friday, January 23, 2004 7:59 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] "Nigerian" Filter Creator Helper Why not use Kami's Nigerian Filter? He's done all of the work for you. Just remember to thank him. That sounds interesting, how about a pointer to Kami's site/email/etc.? (Or am I just too far out of it and missed the obvious location somehwere...?) Thanks, and in advance, thanks to Kami and everyone who has created a filter which I might ever use or use for inspiration. Jeff -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Dan Geiser Sent: Wednesday, December 31, 2003 12:15 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] "Nigerian" Filter Creator Helper Hello, All, I'm looking for a type of utility that either specifically was written to do what I describe below or a utility which is a broad-based text massaging/manipulation utility which could be twisted to do the following. I would like a utility that I could feed the bodies of nigerian scam letters into and it would basically create a list of all phrases of world length X to Y where X and Y are both numbers. It would capture information from each scam letter that I feed in and would generate an ordered list of each time the X to Y word length phrase appears in each letter. So, for example, if my X and Y were 3 and 5 it would generate a list of all 3 word, 4 word and 5 word phrases found in each message. Then it would add 1 to the tally of each time this phrase is found in any given unique nigerian scam letter. After I submit a certain letters, e.g. 20 (?), I would have a list of very commonly found phrases in Nigerian scam letters. I could then create a custom filter for DJM based on those phrases. Ultimately my filter might look something like... # JunkMail.Filter.Nigerian.txt BODY 10 CONTAINS Nigerian Federal Ministry BODY 10 CONTAINS prayed for ALLAHS devine mercies BODY 10 CONTAINS shores of Nigeria BODY 10 CONTAINS we solicit for your I was hoping that their might be a small utility that some of the Nigerian scam fighting organizations had released to generate keyphrase lists. Does this sound like a decent idea? Are there any good utilities to do this? Or is this something I'd have to write myself? Would it be prohibitively complicated to write a program like this for a person who hasn't done much programming? Or is this pretty straightforward? Thanks In Advance, Dan -- - Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E
Re[2]: [Declude.JunkMail] Nigerian Filter Creator Helper
Hello Kevin, Friday, January 23, 2004, 12:37:37 PM, you wrote: KB I have been testing Kami's Nigerian filter and found that in 3 days it KB flagged 56 email and only caught out of 5 nigerian scam emails. KB I do not see this as a fault of Kami's effort but a fault of filtering. Some KB of the line are very common in ligitimate email. I even lowered all the KB weights to match our weighting scores. We will not be using it. Once I did KB that then the nigerian scam email did not get enough weight to be flagged KB properly. KB For the effort it is not worth the results, in my opinion. Sniffer has a number of rules for nigerian scam email. So far we've never had a reported false positive for one of those rules. Perhaps the reason is that we can provide more complex filtering matching combinations of phrases from different segments of the message. _M __ Peter G McNeil (Madscientist, CodeDweller) President, MicroNeil Research Corporation. Chief SortMonster, www.SortMonster.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Nigerian Filter Creator Helper
Yes. I also have it very near the bottom of my list because it has a lot of body searches, and it rarely gets hit. Even so, setting SKIPIFWEIGHT to 28 while holding at 10 and deleting at 25 means that my best custom filter tops out at 3% of total mail volume. Even GIBBERISH only gets hit 1.21% of the time, however without SKIPIFWEIGHT and proper ordering, it would probably do over 5 times that amount. Here's some stats, but note that SNIFFER was a trial version for this period and would have scored much higher. My weight tests are as follows: HIGH-MAILPURE - Scored between 10 and 24 and was held. MED-MAILPURE - Scored between 13 and 24 and was held. LOW-MAILPURE - Scored between 16 and 24 and was held. DELETE - Scored 25+ and was deleted. Matt TEST # FAILED Percentage NOLEGITCONTENT...22,816...86.96% DELETE...21,592...82.30% IPNOTINMX21,551...82.14% SPAMCOP(ALL).17,664...67.33% SPAMCOP(DYNA)17,281...65.87% SNIFFER-GENERAL..15,120...57.63% CMDSPACE.13,911...53.02% MAILPOLICE-BULK..10,104...38.51% DSBL(ALL).9,606...36.61% DSBL(DYNA)9,520...36.29% SBL...8,716...33.22% XBL(ALL)..8,422...32.10% XBL(DYNA).8,259...31.48% FIVETEN-SPAM(ALL).7,522...28.67% FIVETEN-SPAM(DYNA)7,270...27.71% SORBS-DUL.6,471...24.66% NJABL-DYNA6,297...24.00% RFC-NOABUSE(DUL)..6,253...23.83% AHBL-SOURCES..5,296...20.19% BADHEADERS5,204...19.84% RFC-NOPOSTMASTER(DUL).5,008...19.09% HELOBOGUS.4,207...16.04% NJABL-SOURCES.3,812...14.53% NJABL-PROXIES(ALL)3,582...13.65% NJABL-PROXIES(DYNA)...3,435...13.09% SORBS-SPAM(ALL)...3,191...12.16% SORBS-SPAM(DYNA)..3,152...12.01% SPAMDOMAINS...3,065...11.68% FIVETEN-SUPPORT...2,897...11.04% SORBS-SOCKS(ALL)..2,750...10.48% SORBS-SOCKS(DYNA).2,650...10.10% ROUTING...2,645...10.08% SORBS-HTTP(ALL)...2,5049.54% SORBS-HTTP(DYNA)..2,4109.19% BRAMBSTER.2,3999.14% AHBL-PROXIES(ALL).2,3709.03% AHBL-PROXIES(DYNA)2,2928.74% RFC-DSN(DUL)..2,0807.93% CONCEALED.1,8176.93% SPAMHEADERS...1,3865.28% BASE641,2874.91% SPAMINDICATIVE..9713.70% NJABL-DUL...9573.65% BLITZEDALL(ALL).9563.64% BLITZEDALL(DYNA)8763.34% MAILFROM7772.96% SUBSPACE-15.6972.66% FIVETEN-BULK6142.34% HIGH-MAILPURE...6122.33% PSEUDO-WHITE5652.15% SBBL(ALL)...5432.07% SBBL(DYNA)..5402.06% SOLID(ALL)..5262.00% RFC-BOGUSMX(DUL)5021.91% MED-MAILPURE4951.89% DYNAMIC.4731.80% SOLID(DYNA).4261.62% SUBSPACE-25.4161.59% LOW-MAILPURE4101.56% FORGEDHTML..4031.54% ATTACHMENT..3801.45% COMMMENTS...3351.28% KAMI-COMBINED...3321.27% GIBBERISH...3171.21% FOREIGN.2520.96% SUBSPACE-40.2510.96% WORDFILTER-BODY.2360.90% SNIFFER-MALWARE.2350.90% NJABL-RELAYS(ALL)...2200.84% BADCOUNTRYNOREVDNS..2160.82% NJABL-RELAYS(DYNA)..2150.82% BOUNCED.1980.75% SPAMPOSITIVE1800.69% SORBS-MISC(ALL).1770.67% WORDFILTER-SUBJECT..1710.65% MAILPOLICE-PORN.1630.62% SORBS-MISC(DYNA)1610.61% ORDB(ALL)...1590.61% ORDB(DYNA)..1370.52% BASE64SUB...1240.47% IPLINKED1100.42% DEADMAIL.920.35% PUBLICADDRESS890.34% PSEUDO-BLACK.760.29% GIBBERISHSUB.620.24% NONENGLISH...500.19% @LINKED..350.13% FORGEDHELO-IP350.13% TLD-WESTERNEUROPEAN..350.13% WORDFILTER-MAILFROM..350.13% FORGEDFROM...340.13% ORDB-MODULE(DYNA)330.13% ANTIVIRUS260.10%
Re: Re[2]: [Declude.JunkMail] Nigerian Filter Creator Helper
Hmmm. I tag the subject on weight 14 to 19, delete on 20+. I've had Sniffer weighted at 18 for a while. Reduced it to 16 a couple days ago after adding some additional SORBS tests that are in the lastest global.cfg. Anyway, I've had several Nigerian-type scam emails come through without failing ANY tests. Glenn Z. - Original Message - From: Madscientist [EMAIL PROTECTED] To: Kevin Bilbee [EMAIL PROTECTED] Sent: Friday, January 23, 2004 12:15 PM Subject: Re[2]: [Declude.JunkMail] Nigerian Filter Creator Helper Hello Kevin, Friday, January 23, 2004, 12:37:37 PM, you wrote: KB I have been testing Kami's Nigerian filter and found that in 3 days it KB flagged 56 email and only caught out of 5 nigerian scam emails. KB I do not see this as a fault of Kami's effort but a fault of filtering. Some KB of the line are very common in ligitimate email. I even lowered all the KB weights to match our weighting scores. We will not be using it. Once I did KB that then the nigerian scam email did not get enough weight to be flagged KB properly. KB For the effort it is not worth the results, in my opinion. Sniffer has a number of rules for nigerian scam email. So far we've never had a reported false positive for one of those rules. Perhaps the reason is that we can provide more complex filtering matching combinations of phrases from different segments of the message. _M __ Peter G McNeil (Madscientist, CodeDweller) President, MicroNeil Research Corporation. Chief SortMonster, www.SortMonster.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[2]: [Declude.JunkMail] Nigerian Filter Creator Helper
Does the junkmail fire redirect work for aliased domains. It origionally did not. For example I have an alias setup as [EMAIL PROTECTED] and that points to [EMAIL PROTECTED] and I put REDIRECT @mail.internal d:\junkmailfiles\strict.junkmail In the $default$.junkmail file will it use the redirect file or use the settings in the $default$.junkmail. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Glenn \\ WCNet Sent: Friday, January 23, 2004 12:04 PM To: [EMAIL PROTECTED] Subject: Re: Re[2]: [Declude.JunkMail] Nigerian Filter Creator Helper Hmmm. I tag the subject on weight 14 to 19, delete on 20+. I've had Sniffer weighted at 18 for a while. Reduced it to 16 a couple days ago after adding some additional SORBS tests that are in the lastest global.cfg. Anyway, I've had several Nigerian-type scam emails come through without failing ANY tests. Glenn Z. - Original Message - From: Madscientist [EMAIL PROTECTED] To: Kevin Bilbee [EMAIL PROTECTED] Sent: Friday, January 23, 2004 12:15 PM Subject: Re[2]: [Declude.JunkMail] Nigerian Filter Creator Helper Hello Kevin, Friday, January 23, 2004, 12:37:37 PM, you wrote: KB I have been testing Kami's Nigerian filter and found that in 3 days it KB flagged 56 email and only caught out of 5 nigerian scam emails. KB I do not see this as a fault of Kami's effort but a fault of filtering. Some KB of the line are very common in ligitimate email. I even lowered all the KB weights to match our weighting scores. We will not be using it. Once I did KB that then the nigerian scam email did not get enough weight to be flagged KB properly. KB For the effort it is not worth the results, in my opinion. Sniffer has a number of rules for nigerian scam email. So far we've never had a reported false positive for one of those rules. Perhaps the reason is that we can provide more complex filtering matching combinations of phrases from different segments of the message. _M __ Peter G McNeil (Madscientist, CodeDweller) President, MicroNeil Research Corporation. Chief SortMonster, www.SortMonster.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[2]: [Declude.JunkMail] Nigerian Filter Creator Helper
Does the junkmail fire redirect work for aliased domains. It origionally did not. For example I have an alias setup as [EMAIL PROTECTED] and that points to [EMAIL PROTECTED] and I put REDIRECT @mail.internal d:\junkmailfiles\strict.junkmail In the $default$.junkmail file will it use the redirect file or use the settings in the $default$.junkmail. In this case, Declude JunkMail should use the d:\junkmailfiles\strict.junkmail file. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Nigerian Filter Creator Helper
Hello, All, I'm looking for a type of utility that either specifically was written to do what I describe below or a utility which is a broad-based text massaging/manipulation utility which could be twisted to do the following. I would like a utility that I could feed the bodies of nigerian scam letters into and it would basically create a list of all phrases of world length X to Y where X and Y are both numbers. It would capture information from each scam letter that I feed in and would generate an ordered list of each time the X to Y word length phrase appears in each letter. So, for example, if my X and Y were 3 and 5 it would generate a list of all 3 word, 4 word and 5 word phrases found in each message. Then it would add 1 to the tally of each time this phrase is found in any given unique nigerian scam letter. After I submit a certain letters, e.g. 20 (?), I would have a list of very commonly found phrases in Nigerian scam letters. I could then create a custom filter for DJM based on those phrases. Ultimately my filter might look something like... # JunkMail.Filter.Nigerian.txt BODY 10 CONTAINS Nigerian Federal Ministry BODY 10 CONTAINS prayed for ALLAHS devine mercies BODY 10 CONTAINS shores of Nigeria BODY 10 CONTAINS we solicit for your I was hoping that their might be a small utility that some of the Nigerian scam fighting organizations had released to generate keyphrase lists. Does this sound like a decent idea? Are there any good utilities to do this? Or is this something I'd have to write myself? Would it be prohibitively complicated to write a program like this for a person who hasn't done much programming? Or is this pretty straightforward? Thanks In Advance, Dan --- Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Nigerian Filter Creator Helper
Dan, Why not use Kami's Nigerian Filter? He's done all of the work for you. Just remember to thank him. George -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Wednesday, December 31, 2003 12:15 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Nigerian Filter Creator Helper Hello, All, I'm looking for a type of utility that either specifically was written to do what I describe below or a utility which is a broad-based text massaging/manipulation utility which could be twisted to do the following. I would like a utility that I could feed the bodies of nigerian scam letters into and it would basically create a list of all phrases of world length X to Y where X and Y are both numbers. It would capture information from each scam letter that I feed in and would generate an ordered list of each time the X to Y word length phrase appears in each letter. So, for example, if my X and Y were 3 and 5 it would generate a list of all 3 word, 4 word and 5 word phrases found in each message. Then it would add 1 to the tally of each time this phrase is found in any given unique nigerian scam letter. After I submit a certain letters, e.g. 20 (?), I would have a list of very commonly found phrases in Nigerian scam letters. I could then create a custom filter for DJM based on those phrases. Ultimately my filter might look something like... # JunkMail.Filter.Nigerian.txt BODY 10 CONTAINS Nigerian Federal Ministry BODY 10 CONTAINS prayed for ALLAHS devine mercies BODY 10 CONTAINS shores of Nigeria BODY 10 CONTAINS we solicit for your I was hoping that their might be a small utility that some of the Nigerian scam fighting organizations had released to generate keyphrase lists. Does this sound like a decent idea? Are there any good utilities to do this? Or is this something I'd have to write myself? Would it be prohibitively complicated to write a program like this for a person who hasn't done much programming? Or is this pretty straightforward? Thanks In Advance, Dan -- - Sign up for virus-free and spam-free e-mail with Nexus Technology Group http://www.nexustechgroup.com/mailscan --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
