Nick,

I didn't update the notes when I moved a group of entries from that file to the other, and when I move those things, it eliminated the need for the ANTI-IPLINKED filter. There are FP's possible with IPLINKED, but there is no way to counterbalance them in a generic manner, and they should be quite rare (less than 1 in 1000).

I'll comment these up better sometime soon. It would be nice to know if the Lite versions are causing any issues, because if they aren't, I might throw out the regular versions in favor of them.

Matt



nick wrote:

Great job Matt - again!

One question though - should there be an ANTI-IPLINKED file? You mention one in your notes but I did not see one in the archive.

-Nick


---------- Original Message ---------------------------------- From: Matthew Bramble <[EMAIL PROTECTED]> Reply-To: [EMAIL PROTECTED] Date: Thu, 20 Nov 2003 19:43:42 -0500



Considering Kami's latest find and the general need to protect our customers from this type of thing which is even worse than a virus to the unknown, I have packed up two filters that I have been testing out for a while with very good results. These things target eBay, PayPal and credit card fraud very effectively. These filters are definitely of the 'must have' variety (Declude JunkMail Pro required).

@LINKED searches for either; a character followed by "@" followed by a "www." a TLD followed by a "@", or a "@" followed by an IP address. It will score 3 points for the first combination and a 8 points for the second and third types of combinations (this is conservative scoring based on a fail weight of 10). Note that it can increment a score with successive hits for the ladder two combinations, I haven't had time to separate this stuff out into multiple files for a configuration with less chance of causing problems (though this is fairly well foolproof as is with no problems noticed yet, but it will happen eventually, MAXPOINTS would fix the issue when it comes).

IPLINKED searches for either "http://"; followed by an IP address. This is recommended only at a score of 3 because it could compound with FP issues from the above filter, and it will have issues with Web hosters and designers passing around pre-DNS enabled links. I've seen a few legit automated mailers hit on this due to the designer missing a link update from development, or maybe they just made quick use of a particular server for some reason. It's very useful and highly indicative of spam of course.

I don't have pages for them up yet, so instead they will appear linked on my site from the main Declude Filters page until I get around to putting something up.

  MailPure :: Filter Software :: Declude Filters
  http://www.mailpure.com/software/decludefilters/

Enjoy as always,

Matt




---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Reply via email to