Disarm whitelist not working

[Jody Cleveland]

Hello,

I've got the latest version of MailScanner working with SpamAssassin on
a redhat 3.0 AS server.

I've got the phishing stuff setup so that emails matching that criteria
get {Disarmed} at the front of the subject line. I get quite a few
emails from legitimate companies, that get marked with that. So, I
created the whitelist and added those entries in. But, emails from those
senders are still getting flagged.

Here's one example. It's an email from gamespy:

Received: from destiny.winnefox.org (DESTINY [199.242.176.200]) by
mail.winnefox.org with SMTP (Microsoft Exchange Internet Mail Service
Version 5.5.2657.72)
	id NP4PQLR2; Wed, 29 Jun 2005 12:10:24 -0500
Received: from relay4.ign.com (relay4.ign.com [64.41.179.174])
	by destiny.winnefox.org (Postfix) with SMTP id 20D9B3E40B4
	for <cleveland at mail.winnefox.org>; Wed, 29 Jun 2005 12:09:16
-0500 (CDT)
Received: from siebel1.in.snowball.com (HELO siebel.ign.com)
(10.1.100.122)
  by relay4.ign.com with ESMTP; 29 Jun 2005 10:08:20 -0700
Date: Wed, 29 Jun 2005 09:52:38 -0700
Reply-To: portal-daily-html-request at daily.gamespy.com
From: GameSpy Daily <owner-portal-daily-html at daily.gamespy.com>
Sender: owner-portal-daily-html at daily.gamespy.com
Subject: {Disarmed} More of the Greatest Xbox Games Ever. Plus: New Star
Wars Battlefront II  Details!
Mime-Version: 1.0
X-Sender: owner-portal-daily-html at daily.gamespy.com
X-Sender: GameSpy Daily <owner-portal-daily-html at daily.gamespy.com>
X-List-Software: "Version 3.3.0/27480/25-Mar-2004 09:30:44 Pacific
Standard Time"
To: cleveland at mail.winnefox.org
References: <A11200639618608875207.cleveland at mail.winnefox.org>
Received: from 10.1.100.122 by 10.1.100.122
	with EWP id A11200639618603739060
	for <cleveland at mail.winnefox.org>; Wed, 29 Jun 2005 09:52:38
-0700
Message-ID: <AES459196.9989609.A1120063797379142103 at siebel.ign.com>
Content-Type: text/html; charset="US-ASCII"
X-WALS-MailScanner-Information: Please contact the ISP for more
information
X-WALS-MailScanner: Found to be clean
X-WALS-MailScanner-SpamScore: 2
X-MailScanner-From: owner-portal-daily-html at daily.gamespy.com

In my file phishing.safe.sites.conf I've got this:
*.gamespy.com
*@gamespy.com
*@daily.gamespy.com

Any ideas why those aren't successfully being whitelisted?

--
Jody Cleveland
Computer Support Specialist
cleveland at winnefox.org

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!