4.35.11: more phony phishing phailures

[Ugo Bellavance]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Jeff A. Earickson wrote:
> Julian,
>
> I just got a complaint about this from in-house, where the guy
> has our URL in his signature, and he uses HTML email.  The snippet
> from his HTML email is:
>
> </font><font size=3><a href="http://www.colby.edu/"
> eudora="autourl"><font color="red"><b>MailScanner has detected a
> possible fraud attempt from "www.colby.edu" claiming to be</b></font>
> www.colby.edu<br><br>
>
> The syslog from MailScanner said:
>
> MailScanner[7142]: Found phishing fraud from www.colby.edu claiming to
> be www.colby.edu<br><br>
>
> I suppose the extra br's at the end fouled things up.  Or maybe the
> trailing slash at the end of the URL?  Something to contemplate.
> Boy, I sure wish the msg id could appear in syslog output...
>
> BTW, I just discovered that the default for Eudora 6.1 is both plain and
> html text (they call it "styled text").  Yuck, I hate HTML email.
>

What version of MailScanner are you running?

> Jeff Earickson
> Colby College
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).