phishing net query..

[Julian Field]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Dhawal Doshy wrote:

> Hello All,
>
> Does the phishing net have the necessary logic to understand that
> sub.domain.tld and www.domain.tld mostly have the same nameserver
> maintainers, so something like the below examples ought to be considered
> differently.
>
> MailScanner has detected a possible fraud attempt from
> "info.cafepress.com" claiming to be www.cafepress.com.
>
> MailScanner has detected a possible fraud attempt from "see.sun.com"
> claiming to be www.sun.com

No, and it can't. How many levels of domain should you consider, for
starters?
You can put wildcards in phishing.safe.sites.conf already, so you could
choose to add
*.sun.com or *.cafepress.com if you want to.

>
> Of course phishing.safe.sites.conf will take care of this, but can it be
> done at the MS level, or am i missing it completely? If only my coding
> skills were as good as my complaining skills.
>
> - dhawal
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the Wiki (http://wiki.mailscanner.info/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!