Mailto's being marked as detected fraud attempt.

[Randal, Phil]

You probably can't.

One of our biggest headaches here is so-called "legitimate" newsletters
which, to the untrained eye, are indistinguishable from spam.  They use
the same bulk-emailers that spammers do, and insist on redirecting via
some suspicious link, and contain dodgy html markup.

I personally see these newsletters as being part of the problem.  People
who should know better are often the worst offenders, too.

Whitelisting leaves you open to all sorts of garbage (even
whitelist_from if the spammer runs their own poisoned reverse DNS
lookups).

Cheers,

Phil

----
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK

> -----Original Message-----
> From: MailScanner mailing list
> [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Julian Field
> Sent: 17 November 2004 12:17
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: Mailto's being marked as detected fraud attempt.
>
> How could I improve it?
>
>
> On 17/11/04 12:01 pm, "Martin Hepworth"
> <martinh at SOLID-STATE-LOGIC.COM>
> wrote:
> > Quentin
> >
> > I'm getting alot of reports about 'broken links' reported
> by MS in emails.
> >
> > I quick view of the original message does indeed show the link is
> > broken in some way, mainly people sending out HTML email as
> marketing
> > brochures
> > - ligitimate companies we deal with not 'spam' - where thet
> send out a
> > brokeb link accidentally in footers or do a phishing style
> redirect to
> > a link the text claims not to point to.
> >
> > However it is providing many false positives, and although I'm
> > disabling the anti-phishing feature for those domains with
> a ruleset,
> > it is making me contemplate turning off the feature altogether.
> > Otherwise it merely suffers from the cry wolf problem.
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list
> ------------------------ To unsubscribe, email
> jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ
> (http://www.mailscanner.biz/maq/) and the archives
> (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!