Report :Could not analyze message ?

[Martin Hepworth]

I wonder if this is a split line url that's confusing something
ie

ht
tp://
some
where.
net/animage.jpg

alot of these are caught with SA 3.0.3 and the URI-RBL's but they move
around alot and it takes a few hours for the URI-RBL's to catch up.

I note 3.0.2 didn't catch any, but 3.0.3 does so the URL handler must
have been tweeked for 3.0.3. I also hear that 3.1 will definitely catch
these split line URL's..

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Julian Field wrote:
> On 24 May 2005, at 08:41, Andreas Piper wrote:
>
>> Hello all,
>>
>>
>>> Report: MailScanner: Could not analyze message
>>>
>>
>> I am seeing those too since the last few days. In my case it is
>> always a
>> spam-message with Subject:  C$ALIS SOFT  + a random word,
>> containing some
>> MIME-Attachments including a JPEG-File. I have quarantined some of
>> them, and
>> could hand over the queue-files (~13KByte size per message) for
>> further
>> analysis if requested.
>>
>> My setup: MS 4.36.4 with SA 3.0.2 on Debian Sarge (2.4.29-vs1.2.10)
>> with Perl
>> 5.8.4 and sendmail 8.13.1
>
>
> Particularly interesting that it is happening with 4.36.4.
>
> Sounds like a spammer is pulling a new stunt to try to get around us.
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the Wiki (http://wiki.mailscanner.info/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!