[sanesecurity] Re: False Positive winnow.phish.cm.microsoft.hc.275895 in winnow_phis h_complete_url.ndb
- From: Tom Shaw <tshaw@xxxxxxxx>
- To: sanesecurity@xxxxxxxxxxxxx, "'winnow@xxxxxxxx'" <winnow@xxxxxxxx>
- Date: Tue, 30 Jun 2009 08:21:45 -0400
Thank you Pushing an updated DB out now.
I wish the owners of hotmail, etc. would not continue to put new
domains as footers.
Tom
At 2:14 PM +0200 6/30/09, CLEMENT Francis wrote:
Hello
The sig winnow.phish.cm.microsoft.hc.275895 causes many FP that mark
legitimate Hotmail/Live mails as potential spam ...
It decodes as :
http://www[DOT]messengersurvotremobile[DOT]com/
(replace [DOT] with . :) )
This is a legitimate Microsoft domain (as per registrar tucows), web site
and Url, and this url is placed in some Microsoft Live/Hotmail messages
footers as simple advertising link (generaly as a footer link).
Regards
Francis
Other related posts:
