Hello Nick,
What is your false positive rate with that pattern?
_M
Tuesday, June 6, 2006, 10:05:18 AM, you wrote:
> Hi Markus -
> Markus Gufler wrote:
>>There is also another type of spam (stock spam now with attached png image)
>>this morning passing our filters.
>>
> I am catching these fairly easily -
> a combo filter -
> #combo-stockspammer-png.txt
> SKIPIFWEIGHT 26
> TESTSFAILED END NOTCONTAINS EXTERNAL.REGEX.STOCKSPAMMER.BODY
> BODY 5 CONTAINS Content-Type: image/png;
> #
> The body regex is this:
> src="cid:[a-z0-9]{12}\$[a-z0-9]{8}\$[a-z0-9]{8}@
> -Nick
>>
>>
> #############################################################
> This message is sent to you because you are subscribed to
> the mailing list <sniffer@sortmonster.com>.
> To unsubscribe, E-mail to: <[EMAIL PROTECTED]>
> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]>
> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]>
> Send administrative queries to <[EMAIL PROTECTED]>
--
Pete McNeil
Chief Scientist,
Arm Research Labs, LLC.
#############################################################
This message is sent to you because you are subscribed to
the mailing list <sniffer@sortmonster.com>.
To unsubscribe, E-mail to: <[EMAIL PROTECTED]>
To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]>
To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]>
Send administrative queries to <[EMAIL PROTECTED]>
