RE: [Declude.JunkMail] Combo Filter

[Colbeck, Andrew]

Title: Message

No, Markus, the CMDSPACE is not duplicated inside of Pete's Message Sniffer.   What the Declude CMDSPACE test checks for is in the envelope (the Q*.SMD file) and what Message Sniffer checks is the content of the message itself (D*.SMD).   Andrew.   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler Sent: Monday, January 16, 2006 1:01 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Combo Filter Hi Goran,   I write this because maybe Pete McNeil can clarify it easily. Does SNIFFER have something inside who can identify CMDSPACE? Only if it's not so it would be a good combo filter.   Markus   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Goran Jovanovic Sent: Saturday, January 14, 2006 3:33 PM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] Combo Filter FYI All,   I did my CMDSPACE and SNIFFER (all categories have not broken it up yet) combo filter an let it run all day yesterday. That filter triggered on 37.6% of my mail. I ran it yesterday with weight 0 and monitored, there were no false positives at all.   Turning it on for real today. Looks like another good test that I am finally adding to my mix.   Goran Jovanovic Omega Network Solutions From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Thursday, January 12, 2006 4:47 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Combo Filter   That sounds about right from where I sit. You might also think about doing a combo with DUL lists and CMDSPACE, (timeout) with CMDSPACE, and [no reverse DNS] with CMDSPACE.  All three of these things are highly associated with zombies, and they are also isolated in terms of the conditions that generate the hits. Matt Goran Jovanovic wrote: Ok I tag at 10 and delete at 30   Currently CMDSPACE is 8, SNIFFER is 7 so the combo of these two could be 10? That would make it 25 (not including the default -8 from IPNOTINMX and NOLEGIT) which would still require something else to delete the message.     Goran Jovanovic Omega Network Solutions From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Matt Sent: Thursday, January 12, 2006 4:04 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Combo Filter   Definitely. One of the better points to this combination is that both tests are completely isolated from one another. The only danger is that some bulk E-mail software/providers will trigger CMDSPACE, and Sniffer does have a moderate problem with false positives on bulk E-mail, IMO, so you might get a few false positives on this. Matt Goran Jovanovic wrote: Hi,   Would CMDSPACE and SNIFFER be a good combo test to have? I already have some other combos with SNIFFER.   Thanx   Goran Jovanovic Omega Network Solutions