sniffer  

[sniffer] Re: RulePanic on 3059196

Darin Cox
Tue, 06 Apr 2010 11:34:37 -0700

Hi Pete,

Thanks.

Yes, we did submit a report, but it appears the rule used the wrong set of 
message headers and filtered our customer instead of the spam they were 
reporting.

Darin.


----- Original Message ----- 
From: "Pete McNeil" <madscient...@armresearch.com>
To: "Message Sniffer Community" <sniffer@sortmonster.com>
Sent: Tuesday, April 06, 2010 1:25 PM
Subject: [sniffer] Re: RulePanic on 3059196


On 4/6/2010 12:48 PM, Darin Cox wrote:
> Hi Pete,
>
> We've put a RulePanic in for 3059196, as we're getting a lot of FPs on it.
>
> Can you look at this rule, and/or let me know what it is?
>

The rule is a bit.ly link found in spamtraps.
The link leads to a specific constant-contact list sign-up page.
Message 41510774 was the source -- apparently submitted as spam by your
system.
I will contact you off list with that information.
I have excluded the rule.

_M



#############################################################
This message is sent to you because you are subscribed to
  the mailing list <sniffer@sortmonster.com>.
This list is for discussing Message Sniffer,
Anti-spam, Anti-Malware, and related email topics.
For More information see http://www.armresearch.com
To unsubscribe, E-mail to: <sniffer-...@sortmonster.com>
To switch to the DIGEST mode, E-mail to <sniffer-dig...@sortmonster.com>
To switch to the INDEX mode, E-mail to <sniffer-in...@sortmonster.com>
Send administrative queries to  <sniffer-requ...@sortmonster.com>



#############################################################
This message is sent to you because you are subscribed to
  the mailing list <sniffer@sortmonster.com>.
This list is for discussing Message Sniffer,
Anti-spam, Anti-Malware, and related email topics.
For More information see http://www.armresearch.com
To unsubscribe, E-mail to: <sniffer-...@sortmonster.com>
To switch to the DIGEST mode, E-mail to <sniffer-dig...@sortmonster.com>
To switch to the INDEX mode, E-mail to <sniffer-in...@sortmonster.com>
Send administrative queries to  <sniffer-requ...@sortmonster.com>