Hi, > Most of us weight the results in our mailserver/proxies/miltners and score > the weights in SA/ASSP/etc > > However, the signature was the IP 205.178.189.13 and not the host name. That > IP hosts a lont more > than a reverse DNS would lead you to believe. When it was listed contained a > zeus bot and was infected > also with a iframe attack hosted on that IP. See > http://malware.im/network-solutions-and-wordpress-
Ah, I see. So it was an IP owned by Network Solutions, but used for one of their hosted customers, who was infected. I agree, I would want to reject that outright instead of weighting it. Should we consider all the sanesecurity entries to be stable enough to not be weighted? Incredible. You guys are great. I think I'd rather put my money towards this rather than Sophos SAVI every year. Daniel McDonald, thank you also for your input on amavisd scoring. I'll have to consider that. Thanks again, Alex _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
