[sniffer] Re: Stock spam
It's interesting to see such mixed results posted. It makes me wonder what the differences are between the systems reporting high catch rates (which we also see, once a campaign has been analyzed) and low catch rates. I personally found the importance of triggered updates. I was receiving lots of stock and image spam. I had scheduled updates several times a day so I didn't think that had much to do with it. I couldn't get the Triggered update script to work until last week when I executed each line manually and found my bonehead mistake. Spam has all but disappeared. I would encourage anyone using scheduled updates, no matter how frequently, to move to a Triggered Update script Bill Green dfn Systems # This message is sent to you because you are subscribed to the mailing list sniffer@sortmonster.com. To unsubscribe, E-mail to: [EMAIL PROTECTED] To switch to the DIGEST mode, E-mail to [EMAIL PROTECTED] To switch to the INDEX mode, E-mail to [EMAIL PROTECTED] Send administrative queries to [EMAIL PROTECTED]
[sniffer] Re: Lot of stock spam getting through....
I agree! I could tell Pete was burning the midnight oil by the pattern of Sniffer Updates this morning. Thanks Pete! Bill Green dfn Systems 505-622-7853 [EMAIL PROTECTED] - Original Message - From: George Thompson To: Message Sniffer Community Sent: Friday, July 07, 2006 9:18 AM Subject: [sniffer] Re: Lot of stock spam getting through Hi Pete,I've been a customer for a couple of years and usually don't have much to say via maillists. But I wanted to take a moment this morning and think you for the work you do. Keeping up with this stuff must force you to keep your nose to the grindstone. I really appreciate your work.Thanks again,George ThompsonCheif Technical OfficerLevelfield.com, Incwww.levelfield.comDBA OnlineAgency.comwww.onlineagency.combuilding the Internet one small business at a time I had a big fight with one like that all last night -- there are some unusual characters in the message that made it hard to filter and it took some time to do the analysis (picking through them with a hex editor). I think these are handled now (as of about 0400e this morning) as I don't have any getting through spamtraps at the moment. I will look into it again. _M -- Pete McNeil Chief Scientist, Arm Research Labs, LLC.
[sniffer] Re: Weight Gate Success? Failure?
I've tried Pete's WeightGate with INVURIBL. Original line in Declude Global Config. INV-URIBL external weight E:\INVURIBL\invURIBL.exe %WEIGHT% %REMOTEIP% 5 0 New line INVARIANT external weight e:\tools\ShowMe.exe -50 %WEIGHT% 10 E:\INVURIBL\invURIBL.exe %WEIGHT% %REMOTEIP% 5 0 Account for line Wrap I have verified Invuribl is being called. I'm still confirming Spam Blocking Performance. The resulting CPU savings were no less than stunning. Bill Green dfn Systems INV-URIBL external weight E:\INVURIBL\invURIBL.exe %WEIGHT% %REMOTEIP% 5 0 INVARIANT external weight e:\tool\ShowMe.exe -50 %WEIGHT% 10 E:\INVURIBL\invURIBL.exe %WEIGHT% %REMOTEIP% 5 0 Account for line Wrap - Original Message - From: Pete McNeil [EMAIL PROTECTED] To: Message Sniffer Community sniffer@sortmonster.com Sent: Tuesday, June 13, 2006 9:48 AM Subject: [sniffer] Weight Gate Success? Failure? Hello Sniffer Folks, Is anyone successfully using the WeightGate utility? Anyone having trouble with it? I've literally heard nothing so far ;-) Thanks, _M -- Pete McNeil Chief Scientist, Arm Research Labs, LLC. # This message is sent to you because you are subscribed to the mailing list sniffer@sortmonster.com. To unsubscribe, E-mail to: [EMAIL PROTECTED] To switch to the DIGEST mode, E-mail to [EMAIL PROTECTED] To switch to the INDEX mode, E-mail to [EMAIL PROTECTED] Send administrative queries to [EMAIL PROTECTED] --- [This E-mail scanned for viruses by Declude EVA] --- [This E-mail scanned for viruses by Declude EVA] # This message is sent to you because you are subscribed to the mailing list sniffer@sortmonster.com. To unsubscribe, E-mail to: [EMAIL PROTECTED] To switch to the DIGEST mode, E-mail to [EMAIL PROTECTED] To switch to the INDEX mode, E-mail to [EMAIL PROTECTED] Send administrative queries to [EMAIL PROTECTED]
[sniffer] Re: Weight Gate Success? Failure?
Andrew, Comments inline: Can I be the first to point out that in your example, you're still calling ShowMe.exe and not WeightGate.exe so you will be appending to c:\ShowMe.log with every call? Yes, I've changed that to WeightGate.exe. In my excitement, I copied the line to the email before the change. Another blunder was that strange email from me to me that somehow made it to the list. Sorry. And for those new to the party, I'll explain that what Bill is doing with his modified configuration is to avoid calling InvURIBL when the current Declude weight is less than -50 or more than 10. If it's less than -50, Bill is presumably already heavily negatively weighting known ham senders and thus avoiding calling InvURIBL on messages that are ham. Likewise, it the current weight is more than 10, Bill is assuming the message is already spammy enough and doesn't want InvURIBL to run on those either. I will probably tweak these settings as I survey the results. Bill Green dfn Systems --- [This E-mail scanned for viruses by Declude EVA] # This message is sent to you because you are subscribed to the mailing list sniffer@sortmonster.com. To unsubscribe, E-mail to: [EMAIL PROTECTED] To switch to the DIGEST mode, E-mail to [EMAIL PROTECTED] To switch to the INDEX mode, E-mail to [EMAIL PROTECTED] Send administrative queries to [EMAIL PROTECTED]
