You are viewing a plain text version of this content. The canonical link for it is here.

Posted to users@spamassassin.apache.org by jb...@americanhm.com on 2004/05/13 20:28:39 UTC

Possible Bigevil FP

I believe this may be a false positive in the BigEvil ruleset:

This was from a confirmed sender in the ninewest corporate office (I think
they make shoes).  

May 10 14:16:21 sams1 sendmail[12722]: i4AIGKWJ012722:
from=<us...@ninewest.com>, size=15178, class=0, nrcpts=1,
msgid=<46F618F0A4076744865806E7DEB7C59E01AE006B@jag-exch-nw.jonesapparel.com
>, proto=SMTP, daemon=MTA, relay=mx2.jonesapparel.com [12.149.8.33]

I haven't had any problems with BE in the 4 months that I've been using it.
Has anyone else seem this issue?

Re: Possible Bigevil FP

Posted by Matt Kettler <mk...@evi-inc.com>.

At 02:28 PM 5/13/2004, jburzenski@americanhm.com wrote:
>I believe this may be a false positive in the BigEvil ruleset:
>
>This was from a confirmed sender in the ninewest corporate office (I think 
>they make shoes).
>
>May 10 14:16:21 sams1 sendmail[12722]: i4AIGKWJ012722: 
>from=<us...@ninewest.com>, size=15178, class=0, nrcpts=1, 
>msgid=<46...@jag-exch-nw.jonesapparel.com>, 
>proto=SMTP, daemon=MTA, relay=mx2.jonesapparel.com [12.149.8.33]
>
>I haven't had any problems with BE in the 4 months that I've been using 
>it.  Has anyone else seem this issue?

Since bigevil is a URL based list, not relay based, can you post the 
web-link(s) from the message that triggered bigevil? It'd be hard to 
quantify or correct a FP without knowing what hit.