Phishing Trouble

[Julian Field]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I would suspect you are going through 2 MailScanner servers.
I need to add a bit more intelligence so that it notices it has  
already been tagged once and doesn't tag it a second time.

On 18 Aug 2005, at 09:59, Rabellino Sergio wrote:

> Dear list,
>  I have a trouble with the phishing detection as stated below:
>
> <td class="trouble"><a href="http://www.informit.com/click.ashx? 
> dk=3928&u=3FD68173-50E2-49D5-B1BB-F837D0F828F3&r=%2fnewsletters% 
> 2fwhatsnew.asp%3fni%3d101%26st%3d45774"></b></font><font  
> color="red"><b>MailScanner has detected a possible fraud attempt  
> from "www.informit.com" claiming to be</b></font> <font  
> color="red"><b>MailScanner has detected a possible fraud attempt  
> from "www.informit.com" claiming to be Having trouble viewing the e- 
> mail below?<br />http://www.informit.com/newsletters/whatsnew.asp? 
> ni=101&st=45774</a></td>
>
> I understand why the link is a phishing link, but why the  
> MailScanner fraud message is repeated twice ?
> Regular expression bug ?
>
> I'm using MailScanner 4.44.6 with SA 3.0.4 on Solaris 9/perl 5.8.0.
>
> Thanks.
> -- 
> Dott. Mag. Sergio Rabellino
>
>  Technical Staff
>  Department of Computer Science
>  University of Torino (Italy)
>
> http://www.di.unito.it/~rabser
> Tel. +39-0116706701
> Fax. +39-011751603
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the Wiki (http://wiki.mailscanner.info/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

- -- 
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.0.2 (Build 2425)

iQA/AwUBQwRQ1hH2WUcUFbZUEQIVUgCfV1xJmYcQKuyIQwBvewNA3RPc3ssAn0Sr
biKGOlDgsLVpbTGVV01C5sPT
=eACq
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!