If you have Declude Virus, and can afford the CPU time...
The best phish beater I have is Clam AV and PRESCAN ON.
With bank consolodations, the using the reverse dns can be dicey.
----- Original Message -----
From: "Erik" <[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Friday, February 17, 2006 5:32 PM
Subject: [Declude.JunkMail] Banks (and Ebay) Phising Filters
Help from you all:
We've setup the following individual filters for major banks that are
phising scams (and ebay.com)
Do you see any problems with using the following (we mark as SPAM at
weight
70):
HEADERS END NOTCONTAINS wellsfargo.com
BODY 0 CONTAINS .wellsfargo.com
SUBJECT 30 CONTAINS account
REVDNS 50 NOTENDSWITH .wellsfargo.com
#Give weight back for users that forward or use reply for REAL email from
wellsfargo.com
SUBJECT -40 STARTSWITH re:
SUBJECT -40 STARTSWITH fwd:
SUBJECT -40 STARTSWITH fw:
Citibank uses different REVDNS from what we've noticed.
The envelope from is "generally" @citibank.com and the REVDNS is .ssmb.com
OR .citibank.com or .citicorp.com
How do you all deal with this?
Same with SearsCard.com... they are also Citibank and coming from ssmb.com
---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
