Phishing detection not updating email subject
Ryan Burchfield
ryan at mymegabyte.com
Sun Apr 24 16:38:43 IST 2011
New user of MailScanner here and so far I like it. Very flexible and
powerful.
As part of my installation (v 4.83.5-1) I tested the phishing filters by
crafting a bad link. The filters detect the bad link, insert the warning
into the email and log the detection in my syslog. However, the subject
of the offending email is not updated per my configuration.
I took a peak in Message.pm and it appears to me that it is just an
oversight from a past revision. In many places previous if conditions
pertaining to phishing detection events have been replaced with new ones.
-Ryan
Here is the syslog snippet.
Apr 24 10:08:06 mail MailScanner[1079]: Virus and Content Scanning: Starting
Apr 24 10:08:06 mail sendmail[1089]: p3OF85U7001089: from=<____>,
size=940, class=0, nrcpts=1, msgid=<____>, proto=ESMTP, daemon=MTA,
relay=____
Apr 24 10:08:06 mail dkim-filter[28250]: p3OF85U7001089: no signature data
Apr 24 10:08:16 mail MailScanner[1100]: Found phishing fraud from
http://somenewwebsite.com/ claiming to be www.google.com in p3OF803K001087
Apr 24 10:08:16 mail MailScanner[1079]: Content Checks: Detected and
have disarmed phishing tags in HTML message in p3OF803K001087 from ____
Apr 24 10:08:16 mail MailScanner[1079]: Uninfected: Delivered 1 messages
Apr 24 10:08:16 mail MailScanner[1079]: Deleted 1 messages from
processing-database
Here are the relevant conf sections. (Comments removed for brevity)
Phishing Modify Subject = start
Phishing Subject Text = {Phishing?}
Find Phishing Fraud = yes
Also Find Numeric Phishing = yes
Use Stricter Phishing Net = yes
Highlight Phishing Fraud = yes
Phishing Safe Sites File = %etc-dir%/phishing.safe.sites.conf
Phishing Bad Sites File = %etc-dir%/phishing.bad.sites.conf
Country Sub-Domains List = %etc-dir%/country.domains.conf
More information about the MailScanner
mailing list