Peter H. Lemieux wrote:
Theo Van Dinter wrote:
On Thu, Oct 26, 2006 at 09:46:28AM -0400, Peter H. Lemieux wrote:
Also is there an SA rule that scores messages that contain only a
single base64 part (as opposed to a base64-encoded attachment)? I
doubt many legitimate messages arrive with only a single base64 part.
No, because there are going to be a lot of mails that would hit that.
Really? Maybe it's because I live in the US, but I can't think of a
legitimate message I've ever received consisting only of a base64 blob.
Our of curiosity, how frequently does this appear in the SA ham corpus?
Rather than making anyone else do the work for me, is there something I
can read about how to determine the frequency of different message
features appearing in the corpus?
Most messages sent from a Blackberry would hit this rule, for example.
