Phishing Trouble

[Julian Field]

Attached is a patch for Message.pm which should stop this happening  
again.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 1.2, Application/X-GZIP  1KB. ]
    [ Unable to print this part. ]


    [ Part 1.3: "Attached Text" ]



On 18 Aug 2005, at 10:11, Julian Field wrote:
> * PGP Signed: 08/18/05 at 10:11:50
>
> I would suspect you are going through 2 MailScanner servers.
> I need to add a bit more intelligence so that it notices it has  
> already been tagged once and doesn't tag it a second time.
>
> On 18 Aug 2005, at 09:59, Rabellino Sergio wrote:
>
>
>> Dear list,
>>  I have a trouble with the phishing detection as stated below:
>>
>> <td class="trouble"><a href="http://www.informit.com/click.ashx? 
>> dk=3928&u=3FD68173-50E2-49D5-B1BB-F837D0F828F3&r=%2fnewsletters% 
>> 2fwhatsnew.asp%3fni%3d101%26st%3d45774"></b></font><font  
>> color="red"><b>MailScanner has detected a possible fraud attempt  
>> from "www.informit.com" claiming to be</b></font> <font  
>> color="red"><b>MailScanner has detected a possible fraud attempt  
>> from "www.informit.com" claiming to be Having trouble viewing the  
>> e-mail below?<br />http://www.informit.com/newsletters/ 
>> whatsnew.asp?ni=101&st=45774</a></td>
>>
>> I understand why the link is a phishing link, but why the  
>> MailScanner fraud message is repeated twice ?
>> Regular expression bug ?
>>
>> I'm using MailScanner 4.44.6 with SA 3.0.4 on Solaris 9/perl 5.8.0.
>>
>> Thanks.
>> -- 
>> Dott. Mag. Sergio Rabellino
>>
>>  Technical Staff
>>  Department of Computer Science
>>  University of Torino (Italy)
>>
>> http://www.di.unito.it/~rabser
>> Tel. +39-0116706701
>> Fax. +39-011751603
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>> Support MailScanner development - buy the book off the website!
>>
>>
>
> -- 
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>
> * Julian Field <MailScanner at ecs.soton.ac.uk>
> * 0x1415B654 (L)
>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the Wiki (http://wiki.mailscanner.info/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

-- 
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2, Application/PGP-SIGNATURE  202bytes. ]
    [ Unable to print this part. ]