[sanesecurity] Re: FP

  • From: Tom Shaw <tshaw@xxxxxxxx>
  • To: sanesecurity@xxxxxxxxxxxxx
  • Date: Tue, 6 Apr 2010 05:55:37 -0400

At 9:59 AM +0100 4/6/10, Steve Basford wrote:

 > -----BEGIN PGP SIGNED MESSAGE-----

 Hash: SHA1

 Hi all,

 it seems the sig

 > winnow.malware.cm.miscspam.387930.UNOFFICIAL

 prevents the login to the internet mail thebat.net
 Guess this a FP.
 Please check.



Hi Hans,

I've whitelisted in sigwhitelist.ign2 and removed in winnow sigs, until
Tom can take a look later.
Thanks. It should have blocked HITECHUAE dot COM's - a site which is also listed in google safe browsing. I have determined that either google changed its url approach in its google apps or I had a flaw in processing. Either way this has been fixed and 387930 now correctly blocks the site and not thebat. The sigs were updated at 5:54 EDT and should propagate shortly. 

Thanks for the heads up.

Tom

Other related posts:

  1. Home
  2. sanesecurity
  3. Archive
  4. 04-2010