Re: Problematic e-mails

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Nikolaus Hiebaum wrote:
> Since I don't get so many e-mails of that sort, they tend to slip through, and I wonder if the
> new release of SpamProbe will be able to cope with them. It seems these messages contain
> nothing and hence SpamProbe struggles a bit.
> 
> Here is a sample of what I mean.
[snip]
> 
> As you can see, there is no text, except for "Good Day" and no picture. I actually wonder what
> the purpose of this mail is.

Well content based filters do need content to do their work. :-)

I see stuff like this occaisonally too but it's rare.  It might be less 
so for others.  I have a feeling that your example was from a badly 
programmed worm that didn't deliver its payload, or it might have simply 
been a test of a spammer's network.  Who knows.

It is interesting though that the email received a score of .052 from SP 
so it didn't slide through without some trouble.  If you feel 
adventurous you might try changing the default new word score from 0.3 
to 0.4.  Using that value the example you sent might have been scored as 
spam.  I use 0.3 because I'm more concerned about avoiding false 
positives than I am about catching every single spam.

Another option would be to lower the spam threshold from 0.6 to 0.5. 
Again that would have worked in this case but not in every case and it 
does raise the risk of misclassifying a good email as spam.

To do either of those options you would need to install SP 1.3x4 and use 
the "spamprobe create-config" command to create a config file.  Then 
edit that config file to change

   new_word_score 0.3

to

   new_word_score 0.4

Likewise the spam_threshold setting could be changed from 0.6 to 0.5.

All the best,
++Brian

-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.0.3 (Build 2932)

iQEVAwUBQ6c5zzxRyEoJfXIFAQh1Rgf9FCS5sBOjOYy0lR4C+dnSawcRyXtWWxtF
RqlTItj5qNA5ogLOzvlhUt3BcgcuadNS0c87jXXxiOV5TZjl0Lx6t1p/gr9s9OWy
XLqtfeVuPckX+7dEyZnghw5c4xi7P+inqnVXyxf3J5tHspFlNclbLzLSv1nDFzdq
TWDe8gdELAenOfIgfIzfVLnbRIRWzfPFDhEe7G6ZfBDwKieQ7MyHWllgWWW4+6l8
PXduW1w3NK/yuCCrCaDqhB2eY6C3s0yjSU1JC0Qxw4tVQ8PdDpwC5jlZFAQcEdzz
lG7ewQ4e26GJ/9xPgKZ3xAQ5NWlfmtb+czo6laiBlP2/tS3CzeXP4Q==
=Du/t
-----END PGP SIGNATURE-----


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click