Phishing net doesn't like backslashes...

Julian Field MailScanner at ecs.soton.ac.uk
Wed Apr 6 20:28:11 IST 2005


    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Please try this patch for Message.pm:

-----SNIP-----
--- Message.pm.old 2005-04-05 22:11:00.000000000 +0100
+++ Message.pm        2005-04-06 20:24:49.396377737 +0100
@@ -4729,6 +4729,7 @@
   #print STDERR "Was $linkurl\n";
   $linkurl = "" unless $linkurl =~ /[.\/]/; # Ignore if it is not a
website at all
   $linkurl =~ s/\s+//g; # Remove any whitespace
+  $linkurl =~ s/\\/\//g; # Change \ to / as many browsers do this
   #print STDERR "Is $linkurl\n";
   $linkurl = "" if $linkurl =~ /\@/ && $linkurl !~ /\//; # Ignore emails
   #$linkurl =~ s/(\<\/?[^>]*\>)*//ig; # Remove tags
-----SNIP-----

Seems to work for me. Let me know how you get on.

John Wilcock wrote:

>> <a href="http:\\www.example.com"><font color="red"><b>MailScanner has
>> detected a possible fraud attempt from "http:\\www.example.com" claiming
>> to be</b></font> http:\\www.example.com</a>
>
>
> Not that backslashes should ever be used in URIs, of course, but they
> are occasionally seen in practice and are totally harmless.
>
> John.
>
> --
> -- Over 2500 webcams from ski resorts around the world - www.snoweye.com
> -- Translate your technical documents and web pages    - www.tradoc.fr
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!




More information about the MailScanner mailing list