CF RULES

[Randal, Phil]

It looks very effective so far.  The chickenpox rules give me more problems
with false positives, so I may have to lower the scores on those.

Phil

---------------------------------------------
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
> Behalf Of Michele Neylon :: Blacknight Solutions
> Sent: 19 January 2004 11:12
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: CF RULES
>
>
> How effective is this?
>
> My main concern with implementing extra rules is the risk of
> generating
> false positives..
>
> Mr. Michele Neylon
> Blacknight Internet Solutions Ltd
> http://www.blacknightsolutions.ie/
> http://www.search.ie/
> Tel. + 353 (0)59 9137101
> Lowest price domains in Ireland
>
> > -----Original Message-----
> > From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
> > Behalf Of Randal, Phil
> > Sent: 19 January 2004 10:56
> > To: MAILSCANNER at JISCMAIL.AC.UK
> > Subject: Re: CF RULES
> >
> >
> > I'd recommend the tripwire rule from Chris Santerre's page
> to hit these:
> >
> > http://www.merchantsoverseas.com/wwwroot/gorilla/99_FVGT_Tripwire.cf
> >
> > Cheers,
> >
> > Phil
> >
> > ---------------------------------------------
> > Phil Randal
> > Network Engineer
> > Herefordshire Council
> > Hereford, UK
> >
> > > -----Original Message-----
> > > From: MailScanner mailing list
> [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
> > > Behalf Of Howard
> > > Sent: 19 January 2004 03:20
> > > To: MAILSCANNER at JISCMAIL.AC.UK
> > > Subject: CF RULES
> > >
> > >
> > > I've got the following running fine and was wondering if
> > > anyone had any
> > > comments if I should be running more or less:
> > >
> > > -rw-r--r--    1 root     root         6051 Jan 15 13:34
> backhair.cf
> > > -rw-r--r--    1 root     root        68703 Jan 17 22:56 bigevil.cf
> > > -rw-r--r--    1 root     root        22814 Jan 17 09:18
> chickenpox.cf
> > > -rw-r--r--    1 root     root          302 Jan 16 17:37 local.cf
> > > -rw-r--r--    1 root     root         5589 Jan 15 13:36 popcorn.cf
> > > -rw-r--r--    1 root     root        13914 Jan 18 22:03 uri.cf
> > >
> > > Also, does anyone have any comments on running:
> > > http://www.stearns.org/sa-blacklist/sa-blacklist.2004011401.uri.cf
> > >
> > > Lastly, I get a bunch of these text body mails:
> > >
> > > ucecx ldlmdeh djszrvp vphflvpyh utctkz lwnmy ftxmu
> > > fdodpur ypyced pydsdqeho yfbdhl- ypfoapf- sworudtew sagwngon
> > > loxkx qzderwd
> > > camnjcwr
> > > vxexbqasb, rdtgq zldvrcrh fctzx rarsf.
> > > zznhavso poxgr. uosuxfvdb vbdyq fzwntsti atdyr nomottvm
> inlpzlgf dkazd
> > > fxsowmz kevki ffnznyor cczmfwv
> > > swktch qfttob herbri chzddvvpq- ipaceshqg
> > >
> > > What filter would take care of this?
> > >
> > > Thanks
> > >
> >
>