Another mailscanner patch
John Wilcock <[email protected]>
| Newsgroups | gmane.comp.log.logwatch.devel |
|---|---|
| Message-ID | <[email protected]> |
To keep phishing reports totalled by host only. Earlier versions of MailScanner just report the host in the phishing message, more recent versions report the full URL. The patch allows for both, though I'm not sure that I'm extracting the host in the most efficient way. Feel free to amend if there's a better way... John. -- -- Over 3000 webcams from ski resorts around the world - www.snoweye.com -- Translate your technical documents and web pages - www.tradoc.fr _______________________________________________ Logwatch-Devel mailing list [email protected] http://www2.list.logwatch.org:81/mailman/listinfo/logwatch-devel
mailscanner-phishing.patch
(text/plain, 1.2 KB)
--- mailscanner1.32 2008-05-19 08:57:35.000000000 +0200
+++ /usr/share/logwatch/scripts/services/mailscanner 2008-05-19 08:56:15.000000000 +0200
@@ -258,7 +257,6 @@
$Blacklisted_Host{$1}++;
} elsif ($ThisLine =~ m/^Found phishing fraud from (.+) claiming to be (.+) in (.+)/) {
$MailScan_Phishing++;
- $PhishingSource{$1}++;
#Detailed phishing output set in mailscanner.conf
#With variable mailscanner_phishing_detail = 1
if ($phishing_detail) {
@@ -266,8 +264,20 @@
} else {
$PhishingSourceDest{"$1 claiming to be $2"}++;
}
+ my $temp_ph = $1;
+ if ($temp_ph =~ m/^https?:\/\/([\w\.]+)\//i) {
+ $PhishingSource{$1}++;
+ } else {
+ $PhishingSource{$temp_ph}++;
+ }
} elsif ($ThisLine =~ m/^Found ip-based phishing fraud from (.+) in/) {
$MailScan_Phishing++;
+ my $temp_ph = $1;
+ if ($temp_ph =~ m/^https?:\/\/([\w\.]+)\//i) {
+ $PhishingSource{$1}++;
+ } else {
+ $PhishingSource{$temp_ph}++;
+ }
$PhishingSource{$1}++;
} elsif ($ThisLine =~ m/^HTML-Form tag found in message .+ from (.+)/) {
$MailScan_FormTag++;