Hiya
Is there any way of getting false positives to you other than emailing them
to [EMAIL PROTECTED] ?
My dilemma is that I'm using the same SMTP server for sending email out as
getting email in - so outgoing email is getting spam checked using Message
Sniffer - This means my False Positiv
For the first (known) time I see Message Sniffer filter a valid mail.
The mail is from my Dell salesperson containing a quote.
This is from the IMail log:
20070926 091209 127.0.0.1 SMTPD (064801a658d9)
[143.166.85.206] EHLO ausc60pc101.us.dell.com
20070926 091210 127.0.0.1 SMTPD (0
ing to investigate further and apply white
DC> rules. The others were normal FP reports.
DC> Thanks,
DC> Darin.
DC> - Original Message -
DC> From: "Pete McNeil" <[EMAIL PROTECTED]>
DC> To: "Darin Cox"
DC> Sent: Tuesday, March 21, 2006
;
To: "Darin Cox"
Sent: Tuesday, March 21, 2006 11:52 AM
Subject: Re[2]: [sniffer] False positive processing
On Tuesday, March 21, 2006, 11:37:30 AM, Darin wrote:
DC> Nope. None of them.
DC> I haven't heard back from the replies to a couple of false positives on
the
DC>
On Tuesday, March 21, 2006, 11:37:30 AM, Darin wrote:
DC> Nope. None of them.
DC> I haven't heard back from the replies to a couple of false positives on the
DC> 10th, and we haven't heard anything from our submissions on the 16th (6) and
DC> 17th (2). I don't remember if we've heard anything f
--- Original Message -
From: "Pete McNeil" <[EMAIL PROTECTED]>
To: "Darin Cox"
Sent: Tuesday, March 21, 2006 11:21 AM
Subject: Re: [sniffer] False positive processing
On Tuesday, March 21, 2006, 9:38:46 AM, Darin wrote:
DC>
DC>
DC> Hi Pete,
DC>
DC>
DC>
DC&g
On Tuesday, March 21, 2006, 9:38:46 AM, Darin wrote:
DC>
DC>
DC> Hi Pete,
DC>
DC>
DC>
DC> Are you getting behind on false positive processing? We have
DC> gotten a response in a few days, and are still forwarding false
DC> positives for an FP report that we asked for a while rule on
Hi Pete,
Are you getting behind on false positive
processing? We have gotten a response in a few days, and are still
forwarding false positives for an FP report that we asked for a while rule on
the 10th.
Appreciate you looking into it.
Darin.
Pete,
Thanks for the quicker turnaround in the last few
days for false positive processing. We're seeing about half day
now.
Much appreciated!
Darin.
On Thursday, February 23, 2006, 5:48:55 AM, Kevin wrote:
KR> So when I asked how I would send in false positives, someone mentioned
KR> that I should look up the appropriate log entry and send that in. That
KR> brings up another question. My log file is 270MB and climbing. I've
KR> never opened
, 2006 4:49 AM
To: sniffer@SortMonster.com
Subject: [sniffer] False Positives
So when I asked how I would send in false positives, someone mentioned that
I should look up the appropriate log entry and send that in. That brings up
another question. My log file is 270MB and climbing. I've never o
So when I asked how I would send in false positives, someone mentioned
that I should look up the appropriate log entry and send that in. That
brings up another question. My log file is 270MB and climbing. I've
never opened it cause it's too big. Do you have a reader for your log
files?
I
On Tuesday, February 21, 2006, 11:16:43 AM, Andy wrote:
AS> The only other suggestion I have is to create a 24 hour 'queue' display on
AS> the web site. All you need to show is a column of the sender domain names of
AS> the email (not the entire sender email address). If I submit a false
AS> po
.
Darin.
- Original Message -
From: "Andy Schmidt" <[EMAIL PROTECTED]>
To:
Sent: Tuesday, February 21, 2006 11:16 AM
Subject: RE: Re[2]: [sniffer] False Positive - no reaction?
Hi Pete,
I agree that the email notification is tricky - because you might respond to
spa
I like this idea more than the email notification. I really don't need more
emails.
- Original Message -
From: "Andy Schmidt" <[EMAIL PROTECTED]>
To:
Sent: Tuesday, February 21, 2006 10:16 AM
Subject: RE: Re[2]: [sniffer] False Positive - no reaction?
Hi Pe
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Pete McNeil
Sent: Tuesday, February 21, 2006 11:04 AM
To: Andy Schmidt
Subject: Re[2]: [sniffer] False Positive - no reaction?
On Tuesday, February 21, 2006, 10:16:11 AM, Andy wrote:
AS> Sorry - didn't mean t
On Tuesday, February 21, 2006, 10:16:11 AM, Andy wrote:
AS> Sorry - didn't mean to be "pushy". I just thought that false positives are
AS> worse than missed spam, so I had assumed that they would always be at the
AS> top of the queue.
It is a very tough balancing act. Don't feel bad at all - you'
Fax:+1 201 934-9206
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Pete McNeil
Sent: Tuesday, February 21, 2006 09:55 AM
To: Andy Schmidt
Subject: Re: [sniffer] False Positive - no reaction?
I'm a little behind. I'm going to do false positiv
I'm a little behind. I'm going to do false positives in the next 10
minutes. I only have 20 to do it should go fast. Sorry for the delay.
Thanks,
_M
On Tuesday, February 21, 2006, 9:40:07 AM, Andy wrote:
AS> Hi,
AS> I filed this false positive report a day ago and never heard back.
AS> Just t
On average it takes 2 or three days to hear back on false positives.
Darin.
- Original Message -
From: "Andy Schmidt" <[EMAIL PROTECTED]>
To:
Sent: Tuesday, February 21, 2006 9:40 AM
Subject: [sniffer] False Positive - no reaction?
Hi,
I filed this false positive
Hi,
I filed this false positive report a day ago and never heard back.
Just trying to see if my emails are blocked again.
Phone: +1 201 934-3414 x20 (Business)
Fax:+1 201 934-9206
-Original Message-
From: Andy Schmidt [mailto:[EMAIL PROTECTED]
Sent: Monday, February 20, 2006 10:
On Wednesday, February 15, 2006, 4:48:43 PM, Computer wrote:
CHS> I second the motion. We have been submitting spam for over a year and I
CHS> don't know if a single one was received.
In general, if you've not received an error during delivery, we most
certainly got your message... it may have e
J> Information Systems
JMJ> [EMAIL PROTECTED]
JMJ>
JMJ> -Original Message-
JMJ> From: [EMAIL PROTECTED]
JMJ> [mailto:[EMAIL PROTECTED]
JMJ> On Behalf Of Pete McNeil
JMJ> Sent: Wednesday, February 15, 2006 1:28 PM
JMJ> To: Kevin Rogers
JMJ> Subject: Re: [sniffe
On Wednesday, February 15, 2006, 4:32:14 PM, Robert wrote:
RG> The X-SNF header. Sounds like a good idea. Is there a cheat sheet someplace
RG> for making that happen, if possible, in a Declude / Imail environment?
RG> Thanks ahead of time,
In the distribution the option is described in the .cfg
TECTED]>
To:
Sent: Wednesday, February 15, 2006 4:40 PM
Subject: RE: [sniffer] False Positives
Pete,
Is there anyway to get an automatic response similar to the one listed below
for the FP address, but for submissions to your spam@ address? It would be
nice to get some feedback when submitting
PROTECTED]
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Pete McNeil
Sent: Wednesday, February 15, 2006 1:28 PM
To: Kevin Rogers
Subject: Re: [sniffer] False Positives
On Wednesday, February 15, 2006, 3:54:50 PM, Kevin wrote:
KR> My users have been gett
The X-SNF header. Sounds like a good idea. Is there a cheat sheet someplace
for making that happen, if possible, in a Declude / Imail environment?
Thanks ahead of time,
Rob
---
[This E-mail scanned for viruses by Declude Virus]
This E-Mail came from the Message Sniffer mailing list. For inf
On Wednesday, February 15, 2006, 3:54:50 PM, Kevin wrote:
KR> My users have been getting a lot of FPs by Sniffer lately. They send me
KR> the email with the FULL HEADERS displayed and I forward this email on to
KR> SortMonster. The program they use to analyze incoming submissions check
KR> MY em
Search your sniffer logs and include the log lines for that particular
message.
-Jay
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Kevin Rogers
Sent: Wednesday, February 15, 2006 3:55 PM
To: sniffer@SortMonster.com
Subject: [sniffer] False Positives
My users have been getting a lot of FPs by Sniffer lately. They send me
the email with the FULL HEADERS displayed and I forward this email on to
SortMonster. The program they use to analyze incoming submissions check
MY email headers, determine that SNIFFER was not at fault and sends me
back
Answered off-list
_M
On Tuesday, February 14, 2006, 2:07:48 PM, Steve wrote:
SG> Hello,
SG> Could you please tell me what would cause an email to fail rule # 831417
SG> This was a good email flagged this morning and deleted.
SG> Regards,
SG> Steve Guluk
SG> SGDesign
SG> (949) 661-9333
SG> ICQ
Hello,
Could you please tell me what would cause an email to fail rule # 831417
This was a good email flagged this morning and deleted.
Regards,
Steve Guluk
SGDesign
(949) 661-9333
ICQ: 7230769
This E-Mail came from the Message Sniffer mailing list. For information and
(un)subscription
Hello,
Could you please tell me what would cause an email to fail rule # 831417
This was a good email flagged this morning and deleted.
Regards,
Steve Guluk
SGDesign
(949) 661-9333
ICQ: 7230769
This E-Mail came from the Message Sniffer mailing list. For information and
(un)subscription
On Wednesday, January 18, 2006, 2:14:34 PM, Darin wrote:
DC> Are you just blanket responding to every message to the list with this? If
DC> so, you might be wasting your time. I've been following the list, so I know
DC> things are back to normal after yesterday's snafu.
Sorry about that... It w
TECTED]>
To: "Darin Cox" <[EMAIL PROTECTED]>
Cc: ; <[EMAIL PROTECTED]>
Sent: Wednesday, January 18, 2006 1:40 PM
Subject: Re[2]: [sniffer] False Positives
On Wednesday, January 18, 2006, 8:54:49 AM, Darin wrote:
DC> Agreed. We counted 100 false positives yesterday,
On Wednesday, January 18, 2006, 8:54:49 AM, Darin wrote:
DC> Agreed. We counted 100 false positives yesterday, compared to our normal
DC> rate of less than 5.
DC> No false positives since 6pm ET yesterday, though. Thank goodness.
Please visit:
http://www.mail-archive.com/sniffer@sortmonster.c
On Wednesday, January 18, 2006, 8:42:22 AM, Frederick wrote:
FS> Same with me. Last night there was a rules update and it fixed the problem.
FS> Check the date of your rules update.
Please visit
http://www.mail-archive.com/sniffer@sortmonster.com/msg02346.html
and
http://www.mail-archive.com/
On Wednesday, January 18, 2006, 8:57:56 AM, Ali wrote:
AR> Hi,
AR> Over the last 2 days I have seen a major increase in false positives.
AR> Literally all hotmail and yahoo address are being caught by sniffer
AR> inclusive of other legit domains.
AR> Please confirm what may be causing this and w
D]>
Sent: Wednesday, January 18, 2006 8:42 AM
Subject: Re: [sniffer] False Positives
Same with me. Last night there was a rules update and it fixed the problem.
Check the date of your rules update.
- Original Message -
From: "Ali Resting" <[EMAIL PROTECTED]>
To:
C
Same with me. Last night there was a rules update and it fixed the problem.
Check the date of your rules update.
- Original Message -
From: "Ali Resting" <[EMAIL PROTECTED]>
To:
Cc: <[EMAIL PROTECTED]>
Sent: Wednesday, January 18, 2006 8:57 AM
Subject: [sn
Hi,
Over the last 2 days I have seen a major increase in false positives.
Literally all hotmail and yahoo address are being caught by sniffer
inclusive of other legit domains.
Please confirm what may be causing this and what I can do to resolve the
issue.
Regards,
Ali
---
This message was scan
Hi,
Over the last 2 days I have seen a major increase in false positives.
Literally all hotmail and yahoo address are being caught by sniffer
inclusive of other legit domains.
Please confirm what may be causing this and what I can do to resolve the
issue.
Regards,
Ali
---
This message was scan
On Saturday, October 15, 2005, 3:51:22 PM, Scott wrote:
>
When I submit false positives to Sniffer about half come back rule clean. I then have to go to the logs and pull out those messages and resubmit the false positives with the log lines.
I believe I am FTPing up my log files to Sni
When I submit false positives to Sniffer about
half come back rule clean. I then have to go to the logs and pull out those
messages and resubmit the false positives with the log lines.
I believe I am FTPing up my log files to Sniffer
nightly.
Isn't there a way to automatically pull these
server.
JTL> John T
JTL> eServices For You
>> -Original Message-
>> From: [EMAIL PROTECTED]
>> [mailto:[EMAIL PROTECTED]
JTL> On
>> Behalf Of Pete McNeil
>> Sent: Tuesday, September 13, 2005 4:45 AM
>> To: John Tolmachoff (Lists)
>> Subject: Re
eil
> Sent: Tuesday, September 13, 2005 4:45 AM
> To: John Tolmachoff (Lists)
> Subject: Re[2]: [sniffer] False positive
>
> I have your response in my sent folder.
>
> I will send it again..
>
> _M
>
> On Monday, September 12, 2005, 8:37:52 PM, John wrote:
&g
ices For You
>> -Original Message-
>> From: [EMAIL PROTECTED]
>> [mailto:[EMAIL PROTECTED]
JTL> On
>> Behalf Of Pete McNeil
>> Sent: Friday, September 09, 2005 5:08 AM
>> To: Ali Resting
>> Subject: Re: [sniffer] False positive
>>
>> On
9, 2005 5:08 AM
> To: Ali Resting
> Subject: Re: [sniffer] False positive
>
> On Friday, September 9, 2005, 2:17:31 AM, Ali wrote:
>
> AR> Hi Peter,
>
> AR> I have submited 3 email to [EMAIL PROTECTED] with all the required
> AR> fields as per you instaructi
On Friday, September 9, 2005, 2:17:31 AM, Ali wrote:
Apologies to the list... I intended to send those responses directly.
_M
This E-Mail came from the Message Sniffer mailing list. For information and
(un)subscription instructions go to
http://www.sortmonster.com/MessageSniffer/Help/Help.ht
Here is another copy of my initial reply.
_M
On Friday, September 9, 2005, 2:17:31 AM, Ali wrote:
AR> Hi Peter,
AR> I have submited 3 email to [EMAIL PROTECTED] with all the required
AR> fields as per you instaructions on the website, I have not received any
AR> feedback whether this request ha
On Friday, September 9, 2005, 2:17:31 AM, Ali wrote:
AR> Hi Peter,
AR> I have submited 3 email to [EMAIL PROTECTED] with all the required
AR> fields as per you instaructions on the website, I have not received any
AR> feedback whether this request has been effected.
I cleared the false positives
Hi Peter,
I have submited 3 email to [EMAIL PROTECTED] with all the required
fields as per you instaructions on the website, I have not received any
feedback whether this request has been effected.
Regards
Ali
---
This message was scanned for viruses by the Real Image Anti-virus filters
This
Sent: Thursday, August 11, 2005 7:13 AM
Subject: RE: [sniffer] false positives which catagories?
Scott,
HS = Test says ham, final result was spam. This is an inaccurate ham result.
'False negative'
How are you auto determining that an email that was ham was really spam?
Are you key
measurement.
Darin.
- Original Message -
From: "Keith Johnson" <[EMAIL PROTECTED]>
To:
Sent: Thursday, August 11, 2005 8:13 AM
Subject: RE: [sniffer] false positives which catagories?
Scott,
HS = Test says ham, final result was spam. This is an inaccurate ham result.
r
Sent: Thu 8/4/2005 10:02 AM
To: sniffer@SortMonster.com
Subject: Re: [sniffer] false positives which catagories?
I have my sniffer result histories by category posted at:
http://it.farmprogress.com/declude/Testsbymonth.html
Look about 90% down the page.
- Original Message
I'm pretty sure the rule that caused your trouble has been removed.
_M
On Thursday, August 4, 2005, 7:24:09 PM, Robert wrote:
RM> After two attempts to email support and two attempts to
RM> register a real false positive to [EMAIL PROTECTED], I would be
RM> really grateful for some he
We do respond to all false reports that are made to us if we can
properly identify the sender - and often even if that is not the case.
I will research this further and contact you off list.
Thanks,
_M
On Thursday, August 4, 2005, 7:24:09 PM, Robert wrote:
RM> After two attempts to e
After two attempts to email support and
two attempts to register a real false positive to [EMAIL PROTECTED], I would be
really grateful for some help. I suspect our email attempts may have failed to
reach sortmonster.
All email to and from one of our domains
since about the 21st July is
: [sniffer] false positives which
catagories?
Hi,
I'd like to make a difference in the ways I score
the varions sniffer catagories in Declude.
I hold at 20 and have had the several sniffer
catagories all at 19.
As we are a school for tourism I score sniffer
travel lower
Hi,
I'd like to make a difference in the ways I score
the varions sniffer catagories in Declude.
I hold at 20 and have had the several sniffer
catagories all at 19.
As we are a school for tourism I score sniffer
travel lower but I would like to score some catagories higher, at
20.
If we ha
There is a lot of symantec spam out there (that looks like it's not
from them of course)... It's possible that something used in one of
those made it into their auto confirm, or that a robot picked
something up in a cross reference on a trap.
The only way to tell for sure is to get the SNF log
[EMAIL PROTECTED]
Is there any reason this would be in the sniffer file...I tried to do some
troubleshooting and finally just whitelisted their address...and they got
itbut I don't think Declude was holding it...I have SNIFFER on Delete...
Richard Farris
Ethixs Online
1.270.247. Office
On Tuesday, May 10, 2005, 9:37:29 AM, Judy wrote:
JB> Pete,
JB> Can you send these kinds of emails to Hamed instead of me please.
JB> thanks
I have changed your subscription.
Please note you can alter your sniffer@ list subscription at any time.
Information is on our help page:
http://www.sort
On Tuesday, May 10, 2005, 9:35:59 AM, Frederick wrote:
FS> I am finding that most if not all email from Comcast senders are failing
FS> Sniffer.
Please submit a false positive report to false@ and include matching
SNF log entries if possible.
Thanks,
_M
This E-Mail came from the Message Sni
McNeil
Sent: Monday, May 09, 2005 6:49 PM
To: Chuck Schick
Subject: Re: [sniffer] False Positives.
On Monday, May 9, 2005, 7:40:00 PM, Chuck wrote:
CS> I am all of a sudden having all of the mail from one of our hosted
domains
CS> fail the sniffer-phishing. The domain is srinternational.com -
I am finding that most if not all email from Comcast senders are failing
Sniffer.
Fred
This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
On Monday, May 9, 2005, 7:40:00 PM, Chuck wrote:
CS> I am all of a sudden having all of the mail from one of our hosted domains
CS> fail the sniffer-phishing. The domain is srinternational.com - could you
CS> please check on this. All of the emails are different - just from the same
CS> domain.
I am all of a sudden having all of the mail from one of our hosted domains
fail the sniffer-phishing. The domain is srinternational.com - could you
please check on this. All of the emails are different - just from the same
domain.
Chuck Schick
Warp 8, Inc.
(303)-421-5140
www.warp8.com
This E-
68 matches
Mail list logo
