IP phishing false positive

[Julian Field]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Aargh, my first false positive in months!
It found the numeric IP addresses mentioned in my previous reply to this
thread, discovered I had put too large a score (6) on the
NORMAL_HTTP_TO_IP rule and binned the message.

Oops.

For any others who also didn't get my reply, here it is (more or less)
again:

I have changed the phishing net so that it marks numerical links (where
the two numbers match) with a different warning message.

Add this to your /etc/MailScanner/reports/en/languages.conf (or
equivalent) file:
NumericLinkWarning = <font color="red"><b>MailScanner warning: numerical
links are often malicious:</b></font>
(That should all be on 1 line)

and apply the attached patch to your Message.pm.

This is for 4.40-11 and I don't guarantee your success if you try to
apply the patch to other versions unless you do it by hand.


Mark Nienberg wrote:

> Denis Beauchemin wrote:
>
>> Mark Nienberg wrote:
>>
>>> MailScanner is warning about phishing fraud for links that contain IP
>>> addresses even if the IP address matches the display text.
>>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2, Application/X-GZIP  1.5KB. ]
    [ Unable to print this part. ]