Phishing Detection

[Michael Baird]

On Tue, 2004-11-23 at 19:32 -0500, Gerry Doris wrote:
> On Tue, 23 Nov 2004, Michael Baird wrote:
>
> > I just upgraded from 4.33.5 to 4.36.1, in the hopes of picking up the
> > phishing detection. I'm trying to determine if it is working or not. I
> > have not been able to find any references in any of my mailservers logs
> > to "Phish" or "phish", other then the Found the Phish-BankFraud.eml
> > trojan, which was being detected before I upgraded.
> >
> > I'm wondering what specifically should be logged to my maillog, when a
> > Phishing attack is spotted, where it gets the verbage for this, and if
> > Phishing detection depends on any other features in MailScanner being
> > enabled, like file checks.
> >
> > Regards
> > Michael Baird
>
> I just searched my /var/log/maillog and came up with several "phish"
> attempts.  Actually, I believe most of them are not malicious but just
> redirection to other company servers.  The New York Times is one and the
> Intel news letter always trigers a phishing attempt.
>
> --
> Gerry
Yes, I have 3 inbound MX's, receive 1000+ messages every 10 minutes
each, I have not noticed any phish detections on any of them, been
running for about 6 hours on 4.36.1. This is why I'm concerned something
isn't working right with my config. I have filetype checking disabled,
is this necessary for the phishing detection to work?

Regards
Michael Baird

>
> "The lyfe so short, the craft so long to learne"  Chaucer
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
--
Michael Baird <mike at tc3net.com>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!