[Copfilter] Copy of quarantined email - *** SPAM *** [8.9/7.0] Re: Filtering zip spam

2010-04-29 Thread babedh-d...@biggdog.biz
Hi, > Alex, does Bayes understand/check INSIDE zips, at least for file > properties?  If not, then it is inherently limited (just in this I'm not sure if you're asking me rhetorically here. I really don't know. Is it enough that bayes finds the encoded string as the attachment, and matches that a

Re: Filtering zip spam

2010-04-28 Thread ram
On Tue, 2010-04-27 at 11:08 -0400, Alex wrote: > Hi, > > >> Might as well just block all of \.fr at smtp time for that matter :-) > >> Poor France :( > > > > I mostly do... au revoir Le France > > Somewhat off-topic, but in the interest of increasing awareness, India > reportedly ranks f

Re: Filtering zip spam

2010-04-28 Thread Alex
Hi, > Alex, does Bayes understand/check INSIDE zips, at least for file > properties?  If not, then it is inherently limited (just in this I'm not sure if you're asking me rhetorically here. I really don't know. Is it enough that bayes finds the encoded string as the attachment, and matches that a

Re: Filtering zip spam

2010-04-28 Thread Chip M.
>I'm seeing an increase in zip attachment spam, and hoped someone >could help me figure out why it isn't being properly tagged. Are >others seeing this? Is BAYES_99 being triggered or is it lower? Alex, does Bayes understand/check INSIDE zips, at least for file properties? If not, then it is inhe

Re: Filtering zip spam

2010-04-27 Thread corpus.defero
On Tue, 2010-04-27 at 11:08 -0400, Alex wrote: > Hi, > > >> Might as well just block all of \.fr at smtp time for that matter :-) > >> Poor France :( > > > > I mostly do... au revoir Le France > > Somewhat off-topic, but in the interest of increasing awareness, India > reportedly ranks fi

Re: Filtering zip spam

2010-04-27 Thread Alex
Hi, >> Might as well just block all of \.fr at smtp time for that matter :-) >> Poor France :( > > I mostly do... au revoir Le France Somewhat off-topic, but in the interest of increasing awareness, India reportedly ranks first: http://www.dnaindia.com/mumbai/report_india-ranks-first-in-

Re: Filtering zip spam

2010-04-26 Thread David B Funk
On Mon, 26 Apr 2010, Alex wrote: > Hi, > > I'm seeing an increase in zip attachment spam, and hoped someone could > help me figure out why it isn't being properly tagged. Are others > seeing this? Is BAYES_99 being triggered or is it lower? > > Here's an example: > > http://pastebin.com/h9JwTQ9T >

Re: Filtering zip spam

2010-04-26 Thread corpus.defero
On Tue, 2010-04-27 at 02:16 -0400, Alex wrote: > Hi, > > >> Here's an example: > >> > >> http://pastebin.com/h9JwTQ9T > >> > >> The score is very low. Does someone have an idea of other > >> characteristics that I can flag on? > >> > > Hits for me on this: > > Sanesecurity.Junk.22048.UNOFFICIAL FO

Re: Filtering zip spam

2010-04-26 Thread Alex
Hi, >> Here's an example: >> >> http://pastebin.com/h9JwTQ9T >> >> The score is very low. Does someone have an idea of other >> characteristics that I can flag on? >> > Hits for me on this: > Sanesecurity.Junk.22048.UNOFFICIAL FOUND Ah, very good. I think that might be what I'm missing. How are y

Re: Filtering zip spam

2010-04-26 Thread corpus.defero
On Mon, 2010-04-26 at 20:37 -0400, Alex wrote: > Hi, > > I'm seeing an increase in zip attachment spam, and hoped someone could > help me figure out why it isn't being properly tagged. Are others > seeing this? Is BAYES_99 being triggered or is it lower? > > Here's an example: > > http://pastebi

Filtering zip spam

2010-04-26 Thread Alex
Hi, I'm seeing an increase in zip attachment spam, and hoped someone could help me figure out why it isn't being properly tagged. Are others seeing this? Is BAYES_99 being triggered or is it lower? Here's an example: http://pastebin.com/h9JwTQ9T The score is very low. Does someone have an idea