Suggested phishing net tuning

Quentin Campbell Q.G.Campbell at NEWCASTLE.AC.UK
Fri Nov 19 15:03:03 GMT 2004


I have seen repeated examples of log entries similar to:

Nov 19 05:21:10 cheviot5 MailScanner[14191]: Found phishing fraud from
orders at claiming to be mailto:orders at


Nov 19 05:30:34 cheviot5 MailScanner[14082]: Found phishing fraud from claiming to be

Why might it be dangerous to strip the prefixing "mailto:" in the first
example and the appended script & arguments in the second before doing the

PHONE: +44 191 222 8209     Computing Service, University of Newcastle
FAX:   +44 191 222 8765     Newcastle upon Tyne, United Kingdom, NE1 7RU.
"Any opinions expressed above are mine. The University can get its own."

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ ( and
the archives (

Support MailScanner development - buy the book off the website!

More information about the MailScanner mailing list