On Sat, Jul 21, 2007 at 06:52:14PM -0400, WebTent wrote: > Do I need to tweak my rules scores to catch or is someone else able to > block these otherwise? All of these seem to hit the same two rules, > would it be OK to test for only those two rules and block or raise their > score, or would that hit too much ham? > > 0.6 GMD_PDF_ENCRYPTED BODY: Attached PDF is encrypted > 1.0 TVD_PDF_FINGER01 Mail matches standard pdf spam fingerprint
I don't know what the first rule is so have no information about its hit rates. The second one hits 0 ham in the SA nightly test runs. If you aren't likely to receive legit mails in a similar format, feel free to up that score. -- Randomly Selected Tagline: "I left it unlocked overnight, and it was finally stolen. The insurance check paid for a textbook." - Unknown about the Renault LeCar
pgpizqEvmSBPe.pgp
Description: PGP signature
