<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>Try one of those Chinese domains. Yes, seriously.<br><br><div>-</div><div>Jerry Benton</div><div><a href="http://www.mailborder.com">www.mailborder.com</a></div>Sent from my iPhone</div><div><br>On Jan 24, 2016, at 13:04, Shawn Iverson <<a href="mailto:iversons@rushville.k12.in.us">iversons@rushville.k12.in.us</a>> wrote:<br><br></div><blockquote type="cite"><div><div dir="ltr"><div>This is what I see now...</div><div><br></div><div>17 from <a href="mailto:iversons@rushville.k12.in.us" target="_blank">iversons@rushville.k12.in.us</a></div><div>Jan 24 12:23:36 efa MailScanner[22971]: HTML Img tag found in message 154C112018C.ACA17 from <a href="mailto:iversons@rushville.k12.in.us" target="_blank">iversons@rushville.k12.in.us</a></div><div>Jan 24 12:23:36 efa MailScanner[22971]: Spam Checks: Starting</div><div>Jan 24 12:23:38 efa MailScanner[24427]: Found phishing fraud from <a href="http://www.auda.bad.au/" target="_blank">http://www.auda.bad.au/</a> claiming to be <a href="http://www.auda.org.au" target="_blank">www.auda.org.au</a> in 154C112018C.ACA17</div><div>Jan 24 12:23:38 efa MailScanner[24427]: Found phishing fraud from <a href="http://www.auda.bad.org.au/" target="_blank">http://www.auda.bad.org.au/</a> claiming to be <a href="http://www.auda.org.au" target="_blank">www.auda.org.au</a> in 154C112018C.ACA17</div><div>Jan 24 12:23:38 efa MailScanner[22971]: Content Checks: Detected and have disarmed phishing tags in HTML message in 154C112018C.ACA17 from <a href="mailto:iversons@rushville.k12.in.us" target="_blank">iversons@rushville.k12.in.us</a></div><div><br></div><div>Doesn't really tell me how country.domains.conf is being interpreted, so I added some debugging output to Message.pm...</div><div><br></div><div><div><div>Jan 24 12:59:50 efa MailScanner[30948]: Spam Checks: Starting</div><div>Jan 24 12:59:52 efa MailScanner[31111]: Debug Countries List: domain base and 3rd level match</div><div>Jan 24 12:59:52 efa MailScanner[31111]: Debug Countries List: Previous Match was found</div><div><br></div><div>^ good first url is real and lookup of country.domains.conf occurred and matched first two levels</div><div><br></div><div>Jan 24 12:59:52 efa MailScanner[31111]: Debug Countries List: First and/or second level domains do not match, no lookup of countries</div><div>Jan 24 12:59:52 efa MailScanner[31111]: Found phishing fraud from <a href="http://www.auda.bad.au/">http://www.auda.bad.au/</a> claiming to be <a href="http://www.auda.org.au">www.auda.org.au</a> in 3023A120E78.A9661</div><div><br></div><div>^ good no lookup needed because second tld are not the same</div><div><br></div><div>Jan 24 12:59:52 efa MailScanner[31111]: Debug Countries List: domain base and 3rd level do not match</div><div>Jan 24 12:59:52 efa MailScanner[31111]: Found phishing fraud from <a href="http://www.bad.org.au/">http://www.bad.org.au/</a> claiming to be <a href="http://www.auda.org.au">www.auda.org.au</a> in 3023A120E78.A9661</div><div><br></div><div>^ good domain base matches but 3rd level does not and lookup occurred</div><div><br></div><div>Jan 24 12:59:52 efa MailScanner[31111]: Debug Countries List: First and/or second level domains do not match, no lookup of countries</div><div><br></div><div>^ good final url is a domain.tld not in list</div><div><br></div><div>Jan 24 12:59:53 efa MailScanner[30948]: Content Checks: Detected and have disarmed phishing tags in HTML message in 3023A120E78.A9661 from <a href="mailto:iversons@rushville.k12.in.us">iversons@rushville.k12.in.us</a></div></div></div><div><br></div><div>I'll test some of the more elegant urls in country.domains.conf now that I have working output.</div><div><br></div><div>On Sun, Jan 24, 2016 at 12:14 PM, Shawn Iverson <span dir="ltr"><<a href="mailto:iversons@rushville.k12.in.us" target="_blank">iversons@rushville.k12.in.us</a>></span> wrote:<br></div><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr"><div>Okay so I fed a link that match and don't match country.domains.conf, via email to MailScanner...</div><div><br></div><div>Result doesn't show anything out of the ordinary...</div><div><br></div><div><div>Jan 24 11:56:39 efa MailScanner[17846]: Virus and Content Scanning: Starting</div><div>Jan 24 11:56:39 efa MailScanner[17846]: <A> tag found in message 5906C120064.A9741 from <a href="mailto:iversons@rushville.k12.in.us" target="_blank">iversons@rushville.k12.in.us</a></div><div>Jan 24 11:56:39 efa MailScanner[17846]: HTML Img tag found in message 5906C120064.A9741 from <a href="mailto:iversons@rushville.k12.in.us" target="_blank">iversons@rushville.k12.in.us</a></div><div>Jan 24 11:56:39 efa MailScanner[17846]: Spam Checks: Starting</div><div>Jan 24 11:56:39 efa MailScanner[17846]: Expired 1 records from the SpamAssassin cache</div><div><br></div></div><div>I took a look at some of the code to understand the process better...</div><div><br></div><div><div> ReadCountryDomainList(MailScanner::Config::Value('secondlevellist'))</div><div> unless MailScanner::Config::IsSimpleValue('strictphishing') &&</div><div> MailScanner::Config::Value('strictphishing')</div></div><div><br></div><div>So, in my setup strict phishing is on, so this line is skipped, turning off to do some more testing...</div><div><br></div></div></blockquote></div>
</div></div>
</div></blockquote><blockquote type="cite"><div><span></span><br><span></span><br><span>-- </span><br><span>MailScanner mailing list</span><br><span><a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a></span><br><span><a href="http://lists.mailscanner.info/listinfo/mailscanner">http://lists.mailscanner.info/listinfo/mailscanner</a></span><br><span></span><br></div></blockquote></body></html>