Hi,
I've noticed a large amount of phishing signature false-positives, and
just want to make sure I understand correctly how they work.
I have HeuristicScanPrecedence disabled and all the phishing settings
left as default.
I'm assuming this rule is known to produce a large amount of false-positives?
It catches legitimate mail from priceline, delta, citibank, homedepot,
and wellsfargo. At the least, I would expect some kind of note in the
config file indicating this?
I've successfully whitelisted quite a few of them, but is this the
best approach? Maybe I'm missing more of the main purpose of this rule
because it does seem so prone to false-positives.
Could I also ask someone to review my whitelist entries? Perhaps they
can be optimized or done more succinctly? The manual refers to a
version number (17-). Is this necessary?
X:http\://e\.delta\.com:www\.americanexpress\.com
X:http\://l\.info4\.citi\.com:citibank\.com
X:http\://l\.info4\.citi\.com:citi\.com
X:http\://l\.info4\.citi\.com:http\://i\..+\.citi\.com
X:http\://l\.info4\.citi\.com:http\://namwpm\.eccmp\.com
X:http\://l\.info4\.citi\.com:http\://snamwpm\.eccmp\.com
X:http\://l\.info4\.citi\.com:http\://www\.movable-ink-.+\.com
X:http\://l\.info4\.citi\.com:thankyou\.com
X:http\://l\.info6\.accountonline\.com:bestbuy\.accountonline\.com
X:http\://l\.info6\.accountonline\.com:citibank\.com
X:http\://l\.info6\.accountonline\.com:homedepot\.com
X:http\://l\.info6\.accountonline\.com:http\://namwpm\.eccmp\.com
X:http\://links\.e\.mycustomemail\.com:wellsfargo\.com
X:http\://links\.mkt3772\.com:https\://cdn2\.bondbrandloyalty\.com
X:http\://links\.mkt3772\.com:https\://equitybar\.scene\.ca
X:http\://links\.mkt3772\.com:scene\.ca
X:http\://links\.mkt3772\.com:scotiabank\.com
X:\.links\.mkt3772\.com:\.scotiabank\.com
X:http\://mercedes-benz\.r\.delivery\.net:amextravel\.com
X:http\://mercedes-benz\.r\.delivery\.net:http\://sarankco-preview\.com
X:http\://mercedes-benz\.r\.delivery\.net:membershiprewards\.com
X:http\://mercedes-benz\.r\.delivery\.net:www\.americanexpress\.com
X:http\://mercedes-benz\.r\.delivery\.net:www\.membershiprewards\.com
X:https\://epl\.paypal-communication\.com:https\://pp\.images\.harmony\.epsilon\.com
X:https\://epl\.paypal-communication\.com:www\.paypal\.com
X:https\://t\.co:amazon\.de
X:https\://twitter\.com:https\://ea\.twimg\.com
X:https\://twitter\.com:https\://pbs\.twimg\.com
X:https\://usa\.visa\.com:http\://images\.globalclient\.visa\.com
X:.+arizonafederal\.org:arizonafederal\.org
X:.+\.facebook\.com:https\://www\.arizonafederal\.org
X:http\://www\.wiredbusinessconference\.com:http\://images\.globalclient\.visa\.com
X:\.l\.info4\.citi\.com:\.citibank\.com
X:\.l\.info6\.accountonline\.com:\.citibank\.com
X:\.links\.e\.mycustomemail\.com:\.wellsfargo\.com
X:\.mercedes-benz\.r\.delivery\.net:\.www\.americanexpress\.com
X:\.t\.co:\.amazon\.de
___
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml
