I think that I've stumbled onto a large source of false positives in
legitimate bulk mail. Instead of listing individual mailers that offend
in many cases, it turns out that these are often customers of one of a
few companies, CheetahMail and SilverPOP. Each of these companies uses
URL's in their message bodies that contain random characters. The
CheetahMail can be stopped by looking for their server in the body, i.e.
.chtah.com, and SilverPop seems to have several domains so instead I'm
filtering for their script, i.e. /servlet/ClickThru?. These together
with Yahoo's and CNet's ad servers seem to account for the vast majority
of the false positives that I have been seeing with the GIBBERISH
filter. CheetahMail and SilverPOP seems to have a very respectable
client list, and today I say from chtah.com hits on APC, EdditBauer,
CarFax, Neiman Marcus, Delux, and Newport News...but no more will these
be scored.
Please see the updated files for GIBBERISH and ANTIGIBBERISH that
address this problem. The older versions files have been removed.
Please also let me know any false positives that result, especially from
legitimate bulk mailers which can be excluded with similar methods.
GIBBERISH and ANTIGIBBERISH
http://www.mailpure.com/decludefilters/gibberish/Gibberish_09-16-2003.txt
http://www.mailpure.com/decludefilters/gibberish/AntiGibberish_09-16-2003.txt
Matt
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
