RE: [SAtalk] 2.43 - too many false negatives

2002-12-06 Thread Vivek Khera
> "MM" == Michael Moncur <[EMAIL PROTECTED]> writes: MM> These folks are serious spammers. They even register each of the domain MM> names to look legit. Look up findhsm-list-cluster-182-643.com or any of the MM> others, they're all registered to Daily Promotions. (It's a shame a WHOIS MM> loo

Re: [SAtalk] 2.43 - too many false negatives

2002-12-05 Thread Rich Puhek
Michael Moncur wrote: These folks are serious spammers. They even register each of the domain names to look legit. Look up findhsm-list-cluster-182-643.com or any of the others, they're all registered to Daily Promotions. (It's a shame a WHOIS lookup would be expensive, or this would make an ex

Re: [SAtalk] 2.43 - too many false negatives

2002-12-05 Thread Duncan Findlay
On Thu, Dec 05, 2002 at 05:04:28PM -0700, Michael Moncur wrote: > Actually 6 out of the 14 messages in your corpus are from these people. They > frequently change URLs so it's hard to recognize them. But they all have the > same sparse format and similar URLs that match some of the rules I posted.

Re: [SAtalk] 2.43 - too many false negatives

2002-12-05 Thread John H. DuBois III
On Thu, Dec 05, 2002 at 05:04:28PM -0700, Michael Moncur wrote: > These folks are serious spammers. They even register each of the domain > names to look legit. Look up findhsm-list-cluster-182-643.com or any of the > others, they're all registered to Daily Promotions. (It's a shame a WHOIS > looku

Re: [SAtalk] 2.43 - too many false negatives

2002-12-05 Thread Theo Van Dinter
On Thu, Dec 05, 2002 at 05:04:28PM -0700, Michael Moncur wrote: > Actually 6 out of the 14 messages in your corpus are from these people. They These 2 are MS worms, so SA won't do much with them: From: Blkdiamond120 <[EMAIL PROTECTED]> Message-Id: <[EMAIL PROTECTED]> From: ma_sa <[EMAIL PROTECTE

RE: [SAtalk] 2.43 - too many false negatives

2002-12-05 Thread Michael Moncur
> No, neither of those seems to be the culprit. Actually 6 out of the 14 messages in your corpus are from these people. They frequently change URLs so it's hard to recognize them. But they all have the same sparse format and similar URLs that match some of the rules I posted. They tend to be affil

RE: [SAtalk] 2.43 - too many false negatives

2002-12-05 Thread Paul
No, neither of those seems to be the culprit. I've uploaded my mini-corpus to: http://welshdresser.tripod.com/corpus.gz Paul On December 5, at 5:58pm, Michael Moncur wrote: > Are many of them from "DailyPromotions" or "HiSpeedMedia"?

Re: [SAtalk] 2.43 - too many false negatives

2002-12-05 Thread Rick Macdougall
Rick - Original Message - From: "Michael Moncur" <[EMAIL PROTECTED]> To: "Paul" <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]> Sent: Thursday, December 05, 2002 5:58 PM Subject: RE: [SAtalk] 2.43 - too many false negatives > I just installed SA 2.43 and I am dismay

RE: [SAtalk] 2.43 - too many false negatives

2002-12-05 Thread Michael Moncur
> I just installed SA 2.43 and I am dismayed to find that it lets through > about 25% of the spam I receive -- this with my threshold set to 4.0. Are many of them from "DailyPromotions" or "HiSpeedMedia"? These are a couple of big spammers that are focusing on very clean messages with almost nothi

[SAtalk] 2.43 - too many false negatives

2002-12-05 Thread Paul
I just installed SA 2.43 and I am dismayed to find that it lets through about 25% of the spam I receive -- this with my threshold set to 4.0. I have saved the false-negative spam messages that got through. Is there a helpful place I can upload these so that the developers can take a look?