You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by "Smart,Dan" <Sm...@VMCMAIL.com> on 2004/04/02 00:17:18 UTC
Work on detecting phishing rules
I know some on the list have been working on phishing scheme detection
rules.
How has it been coming?
I think this is a big problem, as it is dangerous, but not being caught by
any of our existing tools.
The site http://www.antiphishing.org has signatures of these mails.
<<Dan>>
Re: Work on detecting phishing rules
Posted by Bob George <ma...@ttlexceeded.com>.
Fred wrote:
> This is the file I've been working on, so far it's done fairly well!
Ah, hadn't realized that was it mirrored on rulesemporium. I think I'll
start using yours!
Thanks,
- Bob
Re: Work on detecting phishing rules
Posted by Fred <sp...@freddyt.com>.
This is the file I've been working on, so far it's done fairly well!
Frederic Tarasevicius
Internet Information Services, Inc.
http://www.i-is.com/
810-794-4400
mailto:info@i-is.com
Smart,Dan wrote:
> I know some on the list have been working on phishing scheme detection
> rules.
>
> How has it been coming?
>
> I think this is a big problem, as it is dangerous, but not being
> caught by any of our existing tools.
>
> The site http://www.antiphishing.org has signatures of these mails.
>
>
> <<Dan>>
Re: Work on detecting phishing rules
Posted by Bob George <ma...@ttlexceeded.com>.
Smart,Dan wrote:
> I know some on the list have been working on phishing scheme detection
> rules.
>
> How has it been coming?
I have a few that seem to catch what I'm checking for using simple
domain (uri) and "signature" matching characteristics. Back in an
earlier thread, there were some excellent tips about using received
checks to see if the origin matched the claimed domain, but I haven't
had time to incorporate those yet.
Here's what I've got so far (watch the wrap):
# Anti-phishing tests
uri __L_URI_EBAY /[\/.:]ebay\.com[\/ ]/i
uri __L_URI_PAYPAL /[\/.:]paypal\.com[\/ ]/i
body __L_PHISHPHRASE
/\b(verify|check).*your.*(information|account)\b/i
meta __L_PHISHY_SCORES (NORMAL_HTTP_TO_IP ||
HTTP_ESCAPED_HOST || HTTP_EXCESSIVE_ESCAPES || RAZOR2_CHECK ||
PYZOR_CHECK || HIDE_WIN_STATUS)
# Anything from legit sources shouldn't have phishy characteristics
meta L_PHISH_URI ((__L_URI_EBAY || __L_URI_PAYPAL) &&
__L_PHISHY_SCORES)
describe L_PHISH_URI Phishy URIs and SA scores
score L_PHISH_URI 0.01
# Anything with phishy phrasing and phishy scores is probably seafood
meta L_PHISH_PHRASE (__L_PHISHPHRASE && __L_PHISHY_SCORES)
describe L_PHISH_PHRASE Phishy phrases and SA scores
score L_PHISH_PHRASE 0.01
- Bob
Re: Work on detecting phishing rules
Posted by Loren Wilton <lw...@earthlink.net>.
> > [...]
> > I think this is a big problem, as it is dangerous, but not being caught
by
> > any of our existing tools.
> >
> > The site http://www.antiphishing.org has signatures of these mails.
>
> Nice, but they display an *image* of the message, often times with
> incomplete or missing headers. I wish we could download the actual
> messages, headers and all!
I sent them email about this yesterday when the link was first posted.
Haven't heard back from them. I have a hunch we may be far better off
collecting these ourselves and building the rules.
Loren
Re: Accented-charactors
Posted by Matt Kettler <mk...@evi-inc.com>.
At 11:43 AM 4/2/2004, Andrew Ott wrote:
> Are there any rules out there that would just handle the amount of
>Accented-characters in a e-mail, and score on that number. It seems to be
>just in the last couple of days half the spam I'm getting has hundreds of
>Accented-characters in it and is getting a 1 to 2 score by spamassassin.
Take a look at the latest antidrug.cf.. I added accented chars to
MALEDYSFUNCTION just the other day.
Basically, these are my current character substitution regexes for a and i:
# i - [i1!|l\xEB\xEC]
# a - [a4@\xE1\xE2]
http://mywebpages.comcast.net/mkettler/sa/antidrug.cf
Accented-charactors
Posted by Andrew Ott <ao...@actcom.net>.
Are there any rules out there that would just handle the amount of
Accented-characters in a e-mail, and score on that number. It seems to be
just in the last couple of days half the spam I'm getting has hundreds of
Accented-characters in it and is getting a 1 to 2 score by spamassassin.
======================================================================
Andrew Ott Email: aott@prairieweb.com or aott@actcom.net
Network Admin/Webmaster Web: www.prairieweb.com or www.actcom.net
======================================================================
Death is Gods way of Dropping Carrier.
God is real, unless declared integer.
God, Root, What's the Difference? - UserFriendly.org
======================================================================
Re: Work on detecting phishing rules
Posted by Bob George <ma...@ttlexceeded.com>.
Smart,Dan wrote:
> [...]
> I think this is a big problem, as it is dangerous, but not being caught by
> any of our existing tools.
>
> The site http://www.antiphishing.org has signatures of these mails.
Nice, but they display an *image* of the message, often times with
incomplete or missing headers. I wish we could download the actual
messages, headers and all!
- Bob