[email protected] wrote:
Hi Al,
Could you please confirm exactly what is the issue you see with the links? As
far as I can see, they use standard link tracking.
^^^^^^^^^^^^^^^^^^^^^^
In my experience that, in and of itself, is often the problem.
The cases I've whitelisted locally are almost always mismatches between
the visible link text and the actual link target, eg:
<a href="tracker.bigesp/path/to/some/thing/hexstring">example.com/link</a>
All too often, "bigesp" seems to go to great lengths to remain
unidentified, by way of cryptic and ever-multiplying domains which
appear, without time-consuming investigation, to be Just Another Spoof.
I would also suggest that using a complete separate TLD for
click-tracking is a good way to *raise* red flags when a message is
inspected by hand; even worse when the domain looks similar to the main
domain - such as "paypal-communications.com" vs "paypal.com".
Use a subdomain (eg "communication.paypal.com", or
"espname.paypal.com"), which is clearly delegated from the organization
potentially being spoofed, rather than Yet Another Similar But Not
Obviously Associated Domain (because the domain registrars clearly can't
be trusted to prevent *these* from being registered by world+dog, and a
disturbing number don't shut down the real spoofs very quickly either).
In short, stop doing the same things that the scammers do, and do things
that the scammers can't.
-kgd
_______________________________________________
clamav-users mailing list
[email protected]
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml
