Suggested phishing net tuning

[Quentin Campbell]

Julian

I have seen repeated examples of log entries similar to:

Nov 19 05:21:10 cheviot5 MailScanner[14191]: Found phishing fraud from
orders at ebnerandsons.com claiming to be mailto:orders at ebnerandsons.com

and

Nov 19 05:30:34 cheviot5 MailScanner[14082]: Found phishing fraud from
www.airmileswineclub.co.uk?wine_11-04=true claiming to be
www.airmileswineclub.co.uk

Why might it be dangerous to strip the prefixing "mailto:" in the first
example and the appended script & arguments in the second before doing the
comparison?

Quentin
--
PHONE: +44 191 222 8209     Computing Service, University of Newcastle
FAX:   +44 191 222 8765     Newcastle upon Tyne, United Kingdom, NE1 7RU.
-------------------------------------------------------------------------
"Any opinions expressed above are mine. The University can get its own."

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!