<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>Yeah, I figured as much. I am going to pull those from the list. I really appreciate you testing this out.<br><br><div>-</div><div>Jerry Benton</div><div><a href="http://www.mailborder.com">www.mailborder.com</a></div>Sent from my iPhone</div><div><br>On Jan 24, 2016, at 13:24, Shawn Iverson <<a href="mailto:iversons@rushville.k12.in.us">iversons@rushville.k12.in.us</a>> wrote:<br><br></div><blockquote type="cite"><div><div dir="ltr">Ok found some issues with unicode characters. Tested the <a href="http://xn--55qx5d.cn" target="_blank">公司.cn</a><br>domain. Something mangled the Chinese in the the link tags...<div><br></div><div>Also, <a href="http://xn--55qx5d.cn" target="_blank">公司.cn</a> can be represented as "<a href="http://xn--55qx5d.cn" target="_blank">xn--55qx5d.cn</a>" as Punycode. Should these be included as well? Also is the issue that the text is "<a href="http://xn--55qx5d.cn" target="_blank">公司.cn</a>" but the link is "<a href="http://xn--55qx5d.cn" target="_blank">xn--55qx5d.cn</a>", which technically is right, but won't match. It appears that MailScanner can't handle this without some changes.</div><div><div><br></div><div><div><div>Jan 24 13:12:16 efa MailScanner[30911]: Spam Checks: Starting</div><div>Jan 24 13:12:18 efa MailScanner[977]: Debug Countries List: First and/or second level domains do not match, no lookup of countries</div><div>Jan 24 13:12:18 efa MailScanner[977]: Found phishing fraud from <a href="http://xn--55qx5d.cn" target="_blank">http://公司.cn</a> claiming to be www.å▒¬å▒¸.cn in D40FA120E78.AAB9A</div><div>Jan 24 13:12:18 efa MailScanner[977]: Debug Countries List: First and/or second level domains do not match, no lookup of countries</div><div>Jan 24 13:12:18 efa MailScanner[977]: Found phishing fraud from <a href="http://somedomain.xn--55qx5d.cn" target="_blank">http://somedomain.公司.cn</a> claiming to be www.somedomain.å▒¬å▒¸.cn in D40FA120E78.AAB9A</div><div>Jan 24 13:12:18 efa MailScanner[977]: Debug Countries List: First and/or second level domains do not match, no lookup of countries</div><div>Jan 24 13:12:18 efa MailScanner[977]: Found phishing fraud from <a href="http://fakedomain.xn--55qx5d.cn/" target="_blank">http://fakedomain.公司.cn/</a> claiming to be www.somedomain.å▒¬å▒¸.cn in D40FA120E78.AAB9A</div><div>Jan 24 13:12:18 efa MailScanner[977]: Debug Countries List: First and/or second level domains do not match, no lookup of countries</div><div>Jan 24 13:12:18 efa MailScanner[30911]: Content Checks: Detected and have disarmed phishing tags in HTML message in D40FA120E78.AAB9A from <a href="mailto:iversons@rushville.k12.in.us" target="_blank">iversons@rushville.k12.in.us</a></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Sun, Jan 24, 2016 at 1:04 PM, Shawn Iverson <span dir="ltr"><<a href="mailto:iversons@rushville.k12.in.us" target="_blank">iversons@rushville.k12.in.us</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr"><div>This is what I see now...</div><div><br></div><div>17 from <a href="mailto:iversons@rushville.k12.in.us" target="_blank">iversons@rushville.k12.in.us</a></div><div>Jan 24 12:23:36 efa MailScanner[22971]: HTML Img tag found in message 154C112018C.ACA17 from <a href="mailto:iversons@rushville.k12.in.us" target="_blank">iversons@rushville.k12.in.us</a></div><div>Jan 24 12:23:36 efa MailScanner[22971]: Spam Checks: Starting</div><div>Jan 24 12:23:38 efa MailScanner[24427]: Found phishing fraud from <a href="http://www.auda.bad.au/" target="_blank">http://www.auda.bad.au/</a> claiming to be <a href="http://www.auda.org.au" target="_blank">www.auda.org.au</a> in 154C112018C.ACA17</div><div>Jan 24 12:23:38 efa MailScanner[24427]: Found phishing fraud from <a href="http://www.auda.bad.org.au/" target="_blank">http://www.auda.bad.org.au/</a> claiming to be <a href="http://www.auda.org.au" target="_blank">www.auda.org.au</a> in 154C112018C.ACA17</div><div>Jan 24 12:23:38 efa MailScanner[22971]: Content Checks: Detected and have disarmed phishing tags in HTML message in 154C112018C.ACA17 from <a href="mailto:iversons@rushville.k12.in.us" target="_blank">iversons@rushville.k12.in.us</a></div><div><br></div><div>Doesn't really tell me how country.domains.conf is being interpreted, so I added some debugging output to Message.pm...</div><div><br></div><div><div><div>Jan 24 12:59:50 efa MailScanner[30948]: Spam Checks: Starting</div><div>Jan 24 12:59:52 efa MailScanner[31111]: Debug Countries List: domain base and 3rd level match</div><div>Jan 24 12:59:52 efa MailScanner[31111]: Debug Countries List: Previous Match was found</div><div><br></div><div>^ good first url is real and lookup of country.domains.conf occurred and matched first two levels</div><div><br></div><div>Jan 24 12:59:52 efa MailScanner[31111]: Debug Countries List: First and/or second level domains do not match, no lookup of countries</div><div>Jan 24 12:59:52 efa MailScanner[31111]: Found phishing fraud from <a href="http://www.auda.bad.au/" target="_blank">http://www.auda.bad.au/</a> claiming to be <a href="http://www.auda.org.au" target="_blank">www.auda.org.au</a> in 3023A120E78.A9661</div><div><br></div><div>^ good no lookup needed because second tld are not the same</div><div><br></div><div>Jan 24 12:59:52 efa MailScanner[31111]: Debug Countries List: domain base and 3rd level do not match</div><div>Jan 24 12:59:52 efa MailScanner[31111]: Found phishing fraud from <a href="http://www.bad.org.au/" target="_blank">http://www.bad.org.au/</a> claiming to be <a href="http://www.auda.org.au" target="_blank">www.auda.org.au</a> in 3023A120E78.A9661</div><div><br></div><div>^ good domain base matches but 3rd level does not and lookup occurred</div><div><br></div><div>Jan 24 12:59:52 efa MailScanner[31111]: Debug Countries List: First and/or second level domains do not match, no lookup of countries</div><div><br></div><div>^ good final url is a domain.tld not in list</div><div><br></div><div>Jan 24 12:59:53 efa MailScanner[30948]: Content Checks: Detected and have disarmed phishing tags in HTML message in 3023A120E78.A9661 from <a href="mailto:iversons@rushville.k12.in.us" target="_blank">iversons@rushville.k12.in.us</a></div></div></div><div><br></div><div>I'll test some of the more elegant urls in country.domains.conf now that I have working output.</div><div><br></div></div></blockquote></div>
</div></div></div></div>
</div></blockquote><blockquote type="cite"><div><span></span><br><span></span><br><span>-- </span><br><span>MailScanner mailing list</span><br><span><a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a></span><br><span><a href="http://lists.mailscanner.info/listinfo/mailscanner">http://lists.mailscanner.info/listinfo/mailscanner</a></span><br><span></span><br></div></blockquote></body></html>