Re: Better phish detection

2012-03-18 Thread sporkman
Joseph Brennan wrote: > > > > --On Thursday, March 15, 2012 19:21 -0700 sporkman wrote: > >> -envelope-from is not from our domain, From: line in the message is, >> being >> able to clobber that pattern would be quite helpful by itself. > > > I

Re: Better phish detection

2012-03-16 Thread sporkman
Ned Slider wrote: > > On 16/03/12 02:21, sporkman wrote: >> >> >> >> Ned Slider wrote: >>> >>> On 12/03/12 17:02, David B Funk wrote: >>>> On Mon, 12 Mar 2012, Paul Russell wrote: >>>> >>>>> On 3/10/2012 16:

Re: Better phish detection

2012-03-15 Thread sporkman
Ned Slider wrote: > > On 12/03/12 17:02, David B Funk wrote: >> On Mon, 12 Mar 2012, Paul Russell wrote: >> >>> On 3/10/2012 16:43, Ned Slider wrote: This one is easy enough - if the latter is the only valid url that should ever appear in an email, create a meta rule that looks f

Re: Better phish detection

2012-03-10 Thread sporkman
hamann.w wrote: > >>> >>> >>> Hello, >>> >>> We are getting a fair amount of very targetted phish attempts to our >>> userbase. Since we are relatively small, I don't think any of the >>> URIBLs >>> really help (or phishtank or other lists) since we're not a large bank >>> or >>> paypal or a