Pete,
w3.org would be a huge problem because Outlook will insert this in the
XML headers of any HTML generated E-mail.
If you could give us an idea of when this started and possibly ended,
that would help in the process of review.
Thanks,
Matt
Pete McNeil wrote:
Hello Sniffer Folks,
Watch out for false positives. This morning along with the current
spam storm we discovered that SURBL and SORBs are listing a large
number of ISP domains and anti-spam service/software providers.
As a result, many of these were tagged by our bots due to spam
arriving at our system with those domains and IPs. Most IPs and
domains for these services are coded with "nokens" in our system to
prevent this kind of thing, but a few slipped through.
We are aggressively hunting any more that might have arrived.
You may want to temporarily reduce the weight of the experimental IP
and experimental ad-hoc rule groups until we have identified and
removed the bad rules we don't know about yet.
Please also do your best to report any false positives that you do
identify so that we can remove any bad rules. I don't expect that
there will be too many, but I do want to clear them out quickly if
they are there.
Please also, if you haven't already, review the false positive
procedures:
http://www.sortmonster.com/MessageSniffer/Help/FalsePositivesHelp.html
Pay special attention to the rule-panic procedure and feature in
case you are one of the services hit by these bad entries.
An example of some that we've found in SURBL for example are
declude.com, usinternet.com, and w3.org
It's not clear yet how large the problem is, but I'm sure it will be
resolved soon.
Hope this helps,
Thanks,
_M
Pete McNeil (Madscientist)
President, MicroNeil Research Corporation
Chief SortMonster (www.sortmonster.com)
Chief Scientist (www.armresearch.com)
This E-Mail came from the Message Sniffer mailing list. For information and
(un)subscription instructions go to
http://www.sortmonster.com/MessageSniffer/Help/Help.html
This E-Mail came from the Message Sniffer mailing list. For information and
(un)subscription instructions go to
http://www.sortmonster.com/MessageSniffer/Help/Help.html
