[sniffer] Re: RulePanic on 3059196

2010-04-06 Thread Darin Cox
Hi Pete,

We've put a RulePanic in for 3059196, as we're getting a lot of FPs on it.

Can you look at this rule, and/or let me know what it is?

Thanks,

Darin.

#
This message is sent to you because you are subscribed to
  the mailing list sniffer@sortmonster.com.
This list is for discussing Message Sniffer,
Anti-spam, Anti-Malware, and related email topics.
For More information see http://www.armresearch.com
To unsubscribe, E-mail to: sniffer-...@sortmonster.com
To switch to the DIGEST mode, E-mail to sniffer-dig...@sortmonster.com
To switch to the INDEX mode, E-mail to sniffer-in...@sortmonster.com
Send administrative queries to  sniffer-requ...@sortmonster.com



[sniffer] Re: RulePanic on 3059196

2010-04-06 Thread Colbeck, Andrew
For what it is worth, there are zero hits on my two servers for this
Rule. I looked back through the last 7 days.


Andrew. 



-Original Message-
From: Message Sniffer Community [mailto:snif...@sortmonster.com] On
Behalf Of Darin Cox
Sent: Tuesday, April 06, 2010 9:48 AM
To: Message Sniffer Community
Subject: [sniffer] Re: RulePanic on 3059196


Hi Pete,

We've put a RulePanic in for 3059196, as we're getting a lot of FPs on
it.

Can you look at this rule, and/or let me know what it is?

Thanks,

Darin.

#
This message is sent to you because you are subscribed to
  the mailing list sniffer@sortmonster.com.
This list is for discussing Message Sniffer,
Anti-spam, Anti-Malware, and related email topics.
For More information see http://www.armresearch.com
To unsubscribe, E-mail to: sniffer-...@sortmonster.com
To switch to the DIGEST mode, E-mail to sniffer-dig...@sortmonster.com
To switch to the INDEX mode, E-mail to sniffer-in...@sortmonster.com
Send administrative queries to  sniffer-requ...@sortmonster.com


#
This message is sent to you because you are subscribed to
  the mailing list sniffer@sortmonster.com.
This list is for discussing Message Sniffer,
Anti-spam, Anti-Malware, and related email topics.
For More information see http://www.armresearch.com
To unsubscribe, E-mail to: sniffer-...@sortmonster.com
To switch to the DIGEST mode, E-mail to sniffer-dig...@sortmonster.com
To switch to the INDEX mode, E-mail to sniffer-in...@sortmonster.com
Send administrative queries to  sniffer-requ...@sortmonster.com



[sniffer] Re: RulePanic on 3059196

2010-04-06 Thread Pete McNeil

On 4/6/2010 12:48 PM, Darin Cox wrote:

Hi Pete,

We've put a RulePanic in for 3059196, as we're getting a lot of FPs on it.

Can you look at this rule, and/or let me know what it is?
   


The rule is a bit.ly link found in spamtraps.
The link leads to a specific constant-contact list sign-up page.
Message 41510774 was the source -- apparently submitted as spam by your 
system.

I will contact you off list with that information.
I have excluded the rule.

_M



#
This message is sent to you because you are subscribed to
 the mailing list sniffer@sortmonster.com.
This list is for discussing Message Sniffer,
Anti-spam, Anti-Malware, and related email topics.
For More information see http://www.armresearch.com
To unsubscribe, E-mail to: sniffer-...@sortmonster.com
To switch to the DIGEST mode, E-mail to sniffer-dig...@sortmonster.com
To switch to the INDEX mode, E-mail to sniffer-in...@sortmonster.com
Send administrative queries to  sniffer-requ...@sortmonster.com