Also what did you use to get the report?
Dan Mahoney, System Admin wrote:
On Thu, 26 May 2005, Loren Wilton wrote:
I'm not going to try running that, but I've got a pile of rules that
catch
stock scams like that. SARE has a good bunch of them, the better ones of
course.
Here, the most recent spam I got was a stock spam. It hit:
1.8 LOCAL_OBFU_GENERIC BODY: Obfuscated 'GENERIC' in body
0.6 J_CHICKENPOX_48 BODY: 4alpha-pock-8alpha
0.5 FB_INVEST_ADVICE BODY: /invest.{1,15}advice/i
1.7 SARE_FWDLOOK BODY: Forward looking statements about stocks
0.6 J_CHICKENPOX_71 BODY: 7alpha-pock-1alpha
1.0 LW_LOAN BODY: /\bl.?o.?a.?n\b/i
1.1 FB_SAVE_PERSC BODY: /sav(?:e|ing).{1,45}p[re][re]scription/i
2.0 LW_OTCBB BODY: Reference to stock
1.0 LW_1933 BODY: Reference to Securities Act
0.7 SARE_MONEYTERMS BODY: Talks about money in some way.
0.6 J_CHICKENPOX_53 BODY: 5alpha-pock-3alpha
2.7 NOT_ADVISOR BODY: Not registered investment advisor
0.3 SARE_MILLIONSOF BODY: Millions of something.
0.1 HTML_MESSAGE BODY: HTML included in message
5.4 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
[score: 1.0000]
0.9 FM_NO_STYLE FM_NO_STYLE
Loren,
Where can I find those LW_* rules? Or are they part of your private
collection?
-Dan
--
"Don't try to out-wierd me. I get stranger things than you free with my
breakfast cereal."
-Button seen at I-CON XVII (and subsequently purchased)
--------Dan Mahoney--------
Techie, Sysadmin, WebGeek
Gushi on efnet/undernet IRC
ICQ: 13735144 AIM: LarpGM
Site: http://www.gushi.org
---------------------------
