On 3/16/2011 4:08 PM, Hamad Ali wrote:
Hi folks -- wondering if anyone has monitored SA's performance against
phishing mails. SA is able to detect 86% of phishing emails my clients
get, with 0.5% false positives on all the ham. It seems non-phish-SPAM
is easier to be detected than phish (~99% for non-phish spam). Probably
I need to participate on nightly checks to improve phish and lower false
positives.
But all the above stuff is about bulk-phish, excluding spear phish. I
haven't received any spear phishing complain from my clients, and yet
none of the detected phish mails are spear phish -- which is alarming as
it's too good to be true that no one did spear phishing yet (specially
that it works far better than bulk-phish)!
What's the scenario in your mail systems folks? Do you detect spear
phishing mail by SA? Users report it?
-- H
Are you using spamassassin-3.3.1?
http://www.spamtips.org/p/ultimate-setup-guide.html
Have you tweaked it with the best tested add-ons? Please read this page.
In particular the fuzzy hash based plugins like pyzor, Razor and DCC
sometimes is effective against phishing.
Warren
