I'll share a little trick with the phishing stuff. Anything that contains both a linked IP address and a paypal domain gets enough points to be automatically held by my system at a minimum. I do the same thing with banks an other things, and I don't just limit to domain patterns. For example:

MAXWEIGHT        10
TESTSFAILED   END   NOTCONTAINS   IPLINKED
BODY                     10   CONTAINS           .paypal.com/
SUBJECT                10   CONTAINS           paypal

Matt



Goran Jovanovic wrote:

May be old news to some of you....

href="http://212.217.10.14/data/secure/certificates/SSL/transaction/resu
bmit/login.htm"><tt>http://www.paypal.com/cgi-bin/webscr?cmd=_login-iden
tify

It is in Morocco


Goran Jovanovic The LAN Shoppe --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.





-- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =====================================================

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Reply via email to