Hello John, If they look too much like regular email and they arrive at usertraps then it's a good bet we might skip a few before recognizing they are spam... Rules for usertrap submissions are more strict -- so if there is any doubt we err on the side of safety.
If we get some in our spamtraps they will be coded more quickly. If you see a "chronic" problem with any of them, please zip a few and send them to me at support@ as attachments. Include "Chronic Spam" in your subject line. I will look more closely to find a pattern and will review it with the rule-techs. Thanks! _M Wednesday, July 26, 2006, 4:35:52 PM, you wrote: > Besides the one I sent to the list instead of to spam@, many of the ones > getting through are simple, text-based things that REALLY look like regular > emails. Probably one of the worst kinds to sniff out. > -----Original Message----- > From: Message Sniffer Community [mailto:[EMAIL PROTECTED] On Behalf > Of Pete McNeil > Sent: Wednesday, 26 July 2006 2:52 PM > To: Message Sniffer Community > Subject: [sniffer] Re: New SPAM pain > Hello John, > Wednesday, July 26, 2006, 1:57:18 PM, you wrote: >> I'm dying to start a thread and talk about Sniffer's stance on >> CommTouch, but I can resist. > Me too. >> Instead, I would like to point out that eight clearly spam messages >> have made it through to my Inbox [or Outlook Junk Folder] so far this >> week that appear to have skinned clear through Sniffer. First ones I've > seen in ages. >> Are we undergoing a new phase or campaign that I can make adjustments for? > There has been some impressive activity in new spam campaigns this week, but > nothing is consistently getting past us that I am aware of. > There have been a number of very broken spam campaigns that gave us some > trouble, and a few image spam campaigns that were more complex than most. > Is there anything special you notice about the ones you've mentioned? > _M > PS: I was recently asked where "image spam rules" go so that a customer > could ramp up the weight on that rule group. The vast majority of image spam > rules are abstracts of message structures and occasionally image file > fragments. These rules go in group 61 (Experimental / Abstract). This group > has very low false positive rates as a rule (judging from FP submissions > which are low in general). > -- > Pete McNeil > Chief Scientist, > Arm Research Labs, LLC. > ############################################################# > This message is sent to you because you are subscribed to > the mailing list <sniffer@sortmonster.com>. > To unsubscribe, E-mail to: <[EMAIL PROTECTED]> > To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> > To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> > Send administrative queries to <[EMAIL PROTECTED]> > ############################################################# > This message is sent to you because you are subscribed to > the mailing list <sniffer@sortmonster.com>. > To unsubscribe, E-mail to: <[EMAIL PROTECTED]> > To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> > To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> > Send administrative queries to <[EMAIL PROTECTED]> -- Pete McNeil Chief Scientist, Arm Research Labs, LLC. ############################################################# This message is sent to you because you are subscribed to the mailing list <sniffer@sortmonster.com>. To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]>
