Hello Joey, Simply amazing. I'm sorry we didn't catch that earlier.
Yes, the 137999 rule in question was (it is gone now) a core white rule to pass through messages with PDF attachments. We were so focused on making rules that match the spam that nobody saw or thought to look for the white rule. This is the first report we've seen about that. There are very, very few core white rules - few enough to count on your fingers and toes. Now there is one less. Thanks! _M Saturday, June 30, 2007, 8:10:13 AM, you wrote: > So far I've been lucky and very little of this PDF spam y'all have > been talking about has been getting through to my site. In fact, I've > only seen one, just this morning. > What's confusing me (and this comes from an admittedly less than > perfect understanding of how Sniffer works) is.... well, here, let me > quote you the message headers (running under MDaemon): > X-MessageSniffer-Message: md50001044544.msg > X-MessageSniffer-Rules: [ID-key-obfuscated]-MDPv0.53b (SNFv2-3.1i2) > 0-137999-765-794-m > 61-1477630-375-826-m > 61-1473644-829-902-m > 0-137999-765-794-f > X-MessageSniffer-Result: 0 > If I'm reading this right, the message in question triggered two rules > with a score of "61" and two other rules with a score of "0". The "0" > trumps the "61"??? -- Pete McNeil Chief Scientist, Arm Research Labs, LLC. ############################################################# This message is sent to you because you are subscribed to the mailing list <[email protected]>. To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]>
