MS Outlook "outbind" phishing detection

[Ken A]

#diff Message.pm.orig Message.pm
5740c5740
<   $linkurl =~ s/^outbind:\/\/\d+\///i; # Remove "outbind://22/" type 
labels
---
 >   $linkurl =~ s/^outbind:\/\/\d+\//http:\/\//i; # Remove 
"outbind://22/" type labels

All fine here. I don't have a test file, to be sure it works, but I've 
no reason to think this wouldn't match the http:// part of the url, if 
that's what was causing the problem.

Thanks,
Ken A.
Pacific.Net


Julian Field wrote:
> I have written a tiny patch to solve this problem.
> 
> Please apply the patch to your Message.pm file (in 
> /usr/lib/MailScanner/MailScanner) and let me know how you get on.
> 
> *****
> Beta testers ---- Please can you thoroughly test this patch. Thanks folks!
> *****
> 
> --This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
> MailScanner thanks transtec Computers for their support.
> 
> 
> On 28 Jun 2006, at 08:37, Julian Field wrote:
> 
>> It already removed outbind://<digits>/.....
>>
>> Please can you give me an exact example of the URL that is the 
>> problem, preferably a real example.
>>
>> On 28 Jun 2006, at 00:04, Andy Norris wrote:
>>
>>>
>>> Hi,
>>>
>>> I tried my hardest to find the answer on my own...
>>>
>>> I have a customer who sent me a message a bit ago unhappy that their 
>>> outbound mail to a customer of theirs had the warning phishing 
>>> message at the bottom of their email because Outlook put in 
>>> "outbind://....".
>>>
>>> What to do? Is there a way to tweak the phishing rules to allow any 
>>> url that starts with "outbind://"?
>>>
>>> Running MailScanner v 4.54.6-1 and SendMail v 8.12.11.
>>>
>>> Thanks in advance for any help,
>>>
>>> Andy Norris
>>>
>>> --MailScanner mailing list
>>> mailscanner at lists.mailscanner.info
>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>>
>>> Before posting, read http://wiki.mailscanner.info/posting
>>>
>>> Support MailScanner development - buy the book off the website!
>>
>> --Julian Field
>> MailScanner at ecs.soton.ac.uk
>>
>>
>>
>> --This message has been scanned for viruses and
>> dangerous content by MailScanner, and is
>> believed to be clean.
>> MailScanner thanks transtec Computers for their support.
>>
>> --MailScanner mailing list
>> mailscanner at lists.mailscanner.info
>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>
>> Before posting, read http://wiki.mailscanner.info/posting
>>
>> Support MailScanner development - buy the book off the website!
> 
> --Julian Field
> MailScanner at ecs.soton.ac.uk
> 
>