Re: Bank Phishing Rule - please improve

2011-03-20 Thread Ned Slider
On 20/03/11 17:17, Marc Perkel wrote: Want to share your bank list? Here's mine: Mine was embedded in my last reply: headerLOCAL_FROM_BANKFrom:addr =~ /\@(abbey|abbeyinternational|abbeynational|allianceleicester|alliance-leicester|bankofamerica|barclays|cahoot|cbonline|citi

Re: Bank Phishing Rule - please improve

2011-03-20 Thread Marc Perkel
On 3/20/2011 9:57 AM, Ned Slider wrote: On 20/03/11 16:29, Marc Perkel wrote: Just throwing this out there to see if people like this rule and if you would like to improve it. Bank phishing usually involves a lot of phrases to get you to give up your information. This rule looks for 5 matches

Re: Bank Phishing Rule - please improve

2011-03-20 Thread Ned Slider
On 20/03/11 16:29, Marc Perkel wrote: Just throwing this out there to see if people like this rule and if you would like to improve it. Bank phishing usually involves a lot of phrases to get you to give up your information. This rule looks for 5 matches out of the following list. Hi Marc, I g

Bank Phishing Rule - please improve

2011-03-20 Thread Marc Perkel
Just throwing this out there to see if people like this rule and if you would like to improve it. Bank phishing usually involves a lot of phrases to get you to give up your information. This rule looks for 5 matches out of the following list. body __BANK_PHISH_00 /\byour account\b/i