Re: [sniffer]Re[2]: [sniffer]Numeric spam topic change to png stock spam

[Nick Hayer]

Pete McNeil wrote: Hello Nick, What is your false positive rate with that pattern? Hmm lets go to the MDLP for yesterday  :)                                            SS   HH  HS  SH   SA            SQ REGEX.STOCK.BODY    331    0    0    66    0.667506   0.445565 COMBO.STOCK_PNG   16       0   0     1      0.882353  0.778547 The regex alone will fp; I score it with a 3 [hold on 10; delete on 24] The png combo I just did it last night when I first saw the spam. So far I have not see any fp. [ I combo it (the regex) with other tests as well - which makes it much more reliable.] -Nick _M Tuesday, June 6, 2006, 10:05:18 AM, you wrote: Hi Markus - Markus Gufler wrote: There is also another type of spam (stock spam now with attached png image) this morning passing our filters. I am catching these fairly easily - a combo filter - #combo-stockspammer-png.txt SKIPIFWEIGHT 26 TESTSFAILED END NOTCONTAINS EXTERNAL.REGEX.STOCKSPAMMER.BODY BODY 5 CONTAINS Content-Type: image/png; # The body regex is this: src=""moz-txt-link-freetext" href="">cid:[a-z0-9]{12}\$[a-z0-9]{8}\$[a-z0-9]{8}@ -Nick ############################################################# This message is sent to you because you are subscribed to the mailing list <sniffer@sortmonster.com>. To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]>