Grreting card scams

[UxBoD]

Okay, have done some testing.  For the signature to trigger it has to have a source file that contains the message body, and the following headers :-

MIME-Version: 1.0
Content-Type: text/plain;

otherwise it reports the file as being okay.

Regards,

--[ UxBoD ]--
// PGP Key: "curl -s https://www.splatnix.net/uxbod.asc | gpg --import"
// Fingerprint: C759 8F52 1D17 B3C5 5854  36BD 1FB1 B02F 5DB5 687B
// Keyserver: www.keyserver.net Key-ID: 0x5DB5687B
// Phone: +44 845 869 2749 SIP Phone: uxbod at sip.splatnix.net

----- Original Message -----
From: "Glenn Steen" <glenn.steen at gmail.com>
To: "MailScanner discussion" <mailscanner at lists.mailscanner.info>
Sent: Friday, July 27, 2007 9:02:22 AM (GMT) Europe/London
Subject: Re: Grreting card scams

On 27/07/07, Martin.Hepworth <martinh at solidstatelogic.com> wrote:
> Hmm I don't the DUL RBL's on SA as I they give FP's for us....we have a lot of customers/dealers etc that run their connections over DUL so I turn these off..
>
Phil&Martin,

That SA can (and with the right rules will) catch these feels like a
bit of a side issue here, doesn't it? (Although I do like what you
show there...:)

The fact that a whole bunch of clam sigs are simply missed by use of
MailScanner is, IMO, where we should focus. The question is if there
is anything we (or rather Jules) can do about it... Making clam a
special case, where the header/body separation is ... undone, at least
for the stage of passing it into the scanner... could be one thing.
Some of you boast that you have quite a few such messages, could you
try splitting one into header and body part and see what clamscan says
about the idnividual parts? Just to determine that the theory is
correct...:)

Cheers
-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se
-- 
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.



-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.