Re[2]: [Declude.JunkMail] Nigerian Filter Creator Helper
Hello Kevin, Friday, January 23, 2004, 12:37:37 PM, you wrote: KB I have been testing Kami's Nigerian filter and found that in 3 days it KB flagged 56 email and only caught out of 5 nigerian scam emails. KB I do not see this as a fault of Kami's effort but a fault of filtering. Some KB of the line are very common in ligitimate email. I even lowered all the KB weights to match our weighting scores. We will not be using it. Once I did KB that then the nigerian scam email did not get enough weight to be flagged KB properly. KB For the effort it is not worth the results, in my opinion. Sniffer has a number of rules for nigerian scam email. So far we've never had a reported false positive for one of those rules. Perhaps the reason is that we can provide more complex filtering matching combinations of phrases from different segments of the message. _M __ Peter G McNeil (Madscientist, CodeDweller) President, MicroNeil Research Corporation. Chief SortMonster, www.SortMonster.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: Re[2]: [Declude.JunkMail] Nigerian Filter Creator Helper
Hmmm. I tag the subject on weight 14 to 19, delete on 20+. I've had Sniffer weighted at 18 for a while. Reduced it to 16 a couple days ago after adding some additional SORBS tests that are in the lastest global.cfg. Anyway, I've had several Nigerian-type scam emails come through without failing ANY tests. Glenn Z. - Original Message - From: Madscientist [EMAIL PROTECTED] To: Kevin Bilbee [EMAIL PROTECTED] Sent: Friday, January 23, 2004 12:15 PM Subject: Re[2]: [Declude.JunkMail] Nigerian Filter Creator Helper Hello Kevin, Friday, January 23, 2004, 12:37:37 PM, you wrote: KB I have been testing Kami's Nigerian filter and found that in 3 days it KB flagged 56 email and only caught out of 5 nigerian scam emails. KB I do not see this as a fault of Kami's effort but a fault of filtering. Some KB of the line are very common in ligitimate email. I even lowered all the KB weights to match our weighting scores. We will not be using it. Once I did KB that then the nigerian scam email did not get enough weight to be flagged KB properly. KB For the effort it is not worth the results, in my opinion. Sniffer has a number of rules for nigerian scam email. So far we've never had a reported false positive for one of those rules. Perhaps the reason is that we can provide more complex filtering matching combinations of phrases from different segments of the message. _M __ Peter G McNeil (Madscientist, CodeDweller) President, MicroNeil Research Corporation. Chief SortMonster, www.SortMonster.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[2]: [Declude.JunkMail] Nigerian Filter Creator Helper
Does the junkmail fire redirect work for aliased domains. It origionally did not. For example I have an alias setup as [EMAIL PROTECTED] and that points to [EMAIL PROTECTED] and I put REDIRECT @mail.internal d:\junkmailfiles\strict.junkmail In the $default$.junkmail file will it use the redirect file or use the settings in the $default$.junkmail. Kevin Bilbee -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Glenn \\ WCNet Sent: Friday, January 23, 2004 12:04 PM To: [EMAIL PROTECTED] Subject: Re: Re[2]: [Declude.JunkMail] Nigerian Filter Creator Helper Hmmm. I tag the subject on weight 14 to 19, delete on 20+. I've had Sniffer weighted at 18 for a while. Reduced it to 16 a couple days ago after adding some additional SORBS tests that are in the lastest global.cfg. Anyway, I've had several Nigerian-type scam emails come through without failing ANY tests. Glenn Z. - Original Message - From: Madscientist [EMAIL PROTECTED] To: Kevin Bilbee [EMAIL PROTECTED] Sent: Friday, January 23, 2004 12:15 PM Subject: Re[2]: [Declude.JunkMail] Nigerian Filter Creator Helper Hello Kevin, Friday, January 23, 2004, 12:37:37 PM, you wrote: KB I have been testing Kami's Nigerian filter and found that in 3 days it KB flagged 56 email and only caught out of 5 nigerian scam emails. KB I do not see this as a fault of Kami's effort but a fault of filtering. Some KB of the line are very common in ligitimate email. I even lowered all the KB weights to match our weighting scores. We will not be using it. Once I did KB that then the nigerian scam email did not get enough weight to be flagged KB properly. KB For the effort it is not worth the results, in my opinion. Sniffer has a number of rules for nigerian scam email. So far we've never had a reported false positive for one of those rules. Perhaps the reason is that we can provide more complex filtering matching combinations of phrases from different segments of the message. _M __ Peter G McNeil (Madscientist, CodeDweller) President, MicroNeil Research Corporation. Chief SortMonster, www.SortMonster.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[2]: [Declude.JunkMail] Nigerian Filter Creator Helper
Does the junkmail fire redirect work for aliased domains. It origionally did not. For example I have an alias setup as [EMAIL PROTECTED] and that points to [EMAIL PROTECTED] and I put REDIRECT @mail.internal d:\junkmailfiles\strict.junkmail In the $default$.junkmail file will it use the redirect file or use the settings in the $default$.junkmail. In this case, Declude JunkMail should use the d:\junkmailfiles\strict.junkmail file. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
