Block Postive Phishing Frauds

[Jim Holland]

On Thu, 24 Aug 2006, Peter Russell wrote:

> Yeah i would be happy to stop those 3 entirely. I guess i need to write 
> an SA rule? But one that only catch positive phishing frauds on these 
> topics?

Don't forget that ClamAV identifies well-known phishing frauds and those 
are blocked as if they were viruses. Overnight I see it has caught the 
following on our server:

4   ClamAV:  HTML.Phishing.Bank-491
2   ClamAV:  HTML.Phishing.Pay-178
2   ClamAV:  HTML.Phishing.Bank-503
1   ClamAV:  HTML.Phishing.Pay-94
1   ClamAV:  HTML.Phishing.Pay-201
1   ClamAV:  HTML.Phishing.Card-32
1   ClamAV:  HTML.Phishing.Bank-496
1   ClamAV:  HTML.Phishing.Bank-471
1   ClamAV:  HTML.Phishing.Bank-213
 
> Michele Neylon:: Blacknight.ie wrote:
> > Peter Russell wrote:
> >> I am about to enable phishing fraud detection for the first time - but i
> >> would prefer to block the email rather than forward with a warning.
> >>
> >> How do i easily raise the score of email that get the phishing warning?
> >> Or is there a better way to block these emails?
> >>
> >> Thanks
> >> Pete
> > Strange that you should ask that ....
> > 
> > We've a client in a similar situation that was looking for some way of
> > blocking the paypal / ebay / bank phishes completely, while tagging and
> > delivering the dodgy redirectors .....

Regards

Jim Holland
System Administrator
MANGO - Zimbabwe's non-profit e-mail service