RE: [sniffer] YAhoo mails failing sniffer?
Inversely, I just had a 419 scam come from a legitimate hotmail account, with a Yahoo! Email address as payload, and for the record, that email address (nor anything else) trigger a Sniffer detection. I've just submitted it to the spam@ address. Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Wednesday, September 21, 2005 9:29 PM To: sniffer@SortMonster.com Subject: Re: [sniffer] YAhoo mails failing sniffer? Quick follow-up. The bad rule appears to be 497585. Matt Marc Catuogno wrote: I'm seeing a few legit e-mails from Yahoo failing sniffer. Anyone else? --- [This E-mail scanned for viruses by Declude Virus] This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re[2]: [sniffer] YAhoo mails failing sniffer?
We are training some new folks... We had an issue where part of a tag line used by yahoo was captured from an AFF spam. We discovered in within a very short time and pulled the rule (we do very close review when training). During that short time, unavoidably, some rulebases would have been compiled. If you're describing the same issue then it's definitely fixed. Apologies for this slipping through at all. Thanks, _M On Thursday, September 22, 2005, 12:23:33 AM, William wrote: WVH I got a record number of false-positives from Sniffer yesterday. The WVH category was always Scam Patterns. Two of them were from Yahoo! as well. WVH Although the total was low (something like four FP's total), that is more in WVH one day than I usually see in a month with Sniffer. There must have been WVH some incredibly-badly written code that slipped though, as they were WVH personal e-mails that should never have been tagged. Personal e-mails are WVH really the only ones that I truly consider false positives. I get dozens of WVH mailing list messages trapped each month, but I don't consider those a big WVH deal. Customers rarely miss these. I very, very rarely see any truly WVH personal e-mails get trapped by Sniffer though. Hopefully, they have already WVH fixed the problem. I haven't seen any as of this afternoon. WVH William Van Hefner WVH Network Administrator WVH Vantek Communications, Inc. WVH 555 H Street, Ste. C WVH Eureka, CA 95501 WVH 707.476.0833 ph WVH 800-331.4638 fx -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Marc Catuogno Sent: Wednesday, September 21, 2005 9:09 PM To: sniffer@SortMonster.com Subject: [sniffer] YAhoo mails failing sniffer? I'm seeing a few legit e-mails from Yahoo failing sniffer. Anyone else? --- [This E-mail scanned for viruses by Declude Virus] This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html WVH This E-Mail came from the Message Sniffer mailing list. For WVH information and (un)subscription instructions go to WVH http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
Re[2]: [sniffer] YAhoo mails failing sniffer?
That is the one. That rule is already gone. Again, I apologize. It is all fixed now. Thanks, _M On Thursday, September 22, 2005, 12:29:27 AM, Matt wrote: M Quick follow-up. The bad rule appears to be 497585. M Matt M Marc Catuogno wrote: I'm seeing a few legit e-mails from Yahoo failing sniffer. Anyone else? --- [This E-mail scanned for viruses by Declude Virus] This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html M This E-Mail came from the Message Sniffer mailing list. For M information and (un)subscription instructions go to M http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: Re[2]: [sniffer] YAhoo mails failing sniffer?
When we report these to false what kind of time frame should we get notifications back from AFF? I sent one of these from yahoo yesterday morning and haven't received anything. I can read it on the list before I receive anything from AFF. Thanks, Mike -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: Thursday, September 22, 2005 3:10 AM To: Matt Subject: Re[2]: [sniffer] YAhoo mails failing sniffer? That is the one. That rule is already gone. Again, I apologize. It is all fixed now. Thanks, _M On Thursday, September 22, 2005, 12:29:27 AM, Matt wrote: M Quick follow-up. The bad rule appears to be 497585. M Matt M Marc Catuogno wrote: I'm seeing a few legit e-mails from Yahoo failing sniffer. Anyone else? --- [This E-mail scanned for viruses by Declude Virus] This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html M This E-Mail came from the Message Sniffer mailing list. For M information and (un)subscription instructions go to M http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
RE: [sniffer] auto update tmp files
Sorry I'm late. I had trouble for a while with the "del %1" functionality, but I had a problem with the script running in the wrong directory. I believe I added a "cd \sniffer2" type line and it worked thereafter like a charm. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan HorneSent: Monday, 19 September 2005 11:29 AMTo: sniffer@SortMonster.comSubject: RE: [sniffer] auto update tmp files I have tried to delete %1, but it never seemed to work. I ended up putting a "del *.tmp" at the end of my script and haven't had any problems. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bonno BloksmaSent: Monday, September 19, 2005 9:22 AMTo: sniffer@SortMonster.comSubject: [sniffer] auto update tmp files Hi, Ok, I had auto update pretty much in the air. Seems all I needed was a program alias that fired the script. ;-) There's just one thing, I end up with alot of "tmpID.tmp" files in my spool directory. Any way of deleting those automagically? I could simply delete all tmp.tmp files in my midnight run. Would that be a problem? The only program alias I have is the sniffer update. Met vriendelijke groet, Bonno Bloksma hoofd systeembeheer tio hogeschool toerisme en hospitality julianalaan 9 / 7553 ab hengelo t 074 255 06 10 / f 074 255 06 16 [EMAIL PROTECTED] / www.tio.nl
RE: Re[2]: [sniffer] auto update tmp files
Pete McNeil wrote on Thursday, September 22, 2005 11:24 AM: On Thursday, September 22, 2005, 9:51:31 AM, John wrote: Sorry I'm late. I had trouble for a while with the del %1 functionality, but I had a problem with the script running in the wrong directory. I believe I added a cd \sniffer2 type line and it worked thereafter like a charm. This is a common problem with program aliases in IMail. It is always best to set the working directory at the top of any scripts that run as a program alias so that there is no question where they are running. I've learned that one the hard way a couple of times ;-) _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html Yeah, my script does explicitly enter the sniffer directory, and the line to delete the file is explicit as well: Del s:\imail\spool\%1 ...but that never worked. Maybe if I cd into the spool first it might work, but it is working with current directive, which is: Del s:\imail\spool\*.tmp ...so I really don't have a compelling reason to test it. This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
