FP in Phishing Detection

[Julian Field]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

What version of MailScanner are you running? I've made a few changes 
recently.

Nigel Kendrick wrote:
> Yes, yes, I know it's html in an email, but it's like Canute and the tide
> trying to convince people that although it's pretty it's also a
> pain...anyway...
>
> Here's a block from an email sent by our Marketing lady - notice that
> 'www.petdoctors.co.uk' claims to be 'www.petdoctors.co.uk' - what's tripping
> the phishing alert and is it fixable?
>
> (Look away now if easily offended)
>
> <h1><b><font size=2 color=black face=Tahoma><span lang=EN-US
> style='font-size:
> 10.0pt;font-family:Tahoma'>Find out more about Pet Doctors at <a
> href="http://www.petdoctors.co.uk/"><font color="red"><b>MailScanner has
> detected a possible fraud attempt from "www.petdoctors.co.uk" claiming to
> be</b></font> <font face=Arial><span style='font-family:
> Arial;mso-bidi-font-family:Tahoma'>www.petdoctors.co.uk</span></font></a></s
> pan></font></b><font
> size=3 face=Tahoma><span lang=EN-US
> style='font-size:12.0pt;mso-bidi-font-size:
> 10.0pt;font-family:Tahoma'><o:p></o:p></span></font></h1>
>
> Thanks
>
> Nigel Kendrick
>
>   

Jules

- -- 
Julian Field MEng CITP
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules at Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
For all your IT requirements visit www.transtec.co.uk


-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.3 (Build 3017)
Charset: ISO-8859-1

wj8DBQFGzbNqEfZZRxQVtlQRAj4vAKC6FICrMNOPMJI5EDPEg0iDZ5uRMgCfY6G7
Sa/XOq83aMw8w5WI8Sej50Q=
=qfp9
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
For all your IT requirements visit www.transtec.co.uk