Grreting card scams

[Glenn Steen]

On 27/07/07, Martin.Hepworth <martinh at solidstatelogic.com> wrote:
> Hmm I don't the DUL RBL's on SA as I they give FP's for us....we have a lot of customers/dealers etc that run their connections over DUL so I turn these off..
>
Phil&Martin,

That SA can (and with the right rules will) catch these feels like a
bit of a side issue here, doesn't it? (Although I do like what you
show there...:)

The fact that a whole bunch of clam sigs are simply missed by use of
MailScanner is, IMO, where we should focus. The question is if there
is anything we (or rather Jules) can do about it... Making clam a
special case, where the header/body separation is ... undone, at least
for the stage of passing it into the scanner... could be one thing.
Some of you boast that you have quite a few such messages, could you
try splitting one into header and body part and see what clamscan says
about the idnividual parts? Just to determine that the theory is
correct...:)

Cheers
-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se