John Hardin writes: > Folks: > > I tried posting this to [EMAIL PROTECTED] but it bounced... > > I'm seeing recent 419 spams (e.g. the ATM Card variant) making it > through SA lately. It hits BAYES_99, but no SARE rules. > > Are these rules defunct? > > Suggestion: grabbing Justin Mason's SOUGHT tools and using them against > a 419-specific corpus might be a really good way to keep the fraud > ruleset current without a lot of manual effort...
hi John -- I agree, it'd be a natural. The difficult part is maintaining a corpus, or corpora, of the different "target" types of spam. This "corpus gardening" is time consuming :( However if someone wants to do that on an ongoing basis, and can rsync or upload samples to my site, I'd be happy to create new SOUGHT rulesets for them. Any volunteers? ;) --j.
