{Virus} new phishing (fwd)

[Julian Field]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Peter Peters wrote:

>On Wed, 1 Dec 2004 12:57:54 +0100, you wrote:
>
>
>
>>On my system too, but only antivir found a infection not f-prot.
>>
>>
>
>I didn't have any virus. But I included an IP address from a phishing
>spam.
>
>|It seems phishers read or use MailScanner. Instead of <a
>|href="http://x.x.x.x/s">www.your-favorite-bank.com</a> they start
>|using <a href="http://x.x.x.x/s">signon</a>. And the phishing test
>|doesn't recognize this one.
>|
>|Some people suggested inserting an ALT with something like "The host
>|http://x.x.x.x/s, is a numerical IP address; most legitimate sites
>|use names not addresses."
>|
>|Would this be possible?
>
>I replaced the IP-address.
>
>
There is already a SpamAssassin rule which detects these, you might want
to increase its score.
score NORMAL_HTTP_TO_IP 4
is what I use.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!