Anyone else getting slammed with eBay & PayPal Phising not getting tagged?

[Debbie D <we...@beautytech.com>]

What rules can I add or tweak to stop these??

Your credit/debit card information must be updated

Dear eBay Member,
We recently noticed one or more attempts to log in to your eBay account from 
a foreign IP address and we have reasons to believe that your account was 
used by a third party without your authorization. If you recently accessed 
your account while traveling, the unusual login attempts may have been 
initiated by you
The login attempt was made from:
IP address: 172.25.210.66
ISP Host: cache-66.proxy.aol.com

By now, we used many techniques to verify the accuracy of the information 
our users provide us when they register on the Site. However, because user 
verification on the Internet is difficult, eBay cannot and does not confirm 
each user's purported identity. Thus, we have established an offline 
verification system o help you evaluate with who you are dealing with.


click on the link below, fill the form and then submit as we will verify

http://www.ebay.com/aw-cgi/eBayISAPI.dll?VerifyRegistrationShow

Please save this fraud alert ID for your reference

Please Note - If you choose to ignore our request, you leave us no choice 
but to temporally suspend your account.

Re: Anyone else getting slammed with eBay & PayPal Phising not getting tagged?

["Michele Neylon:: Blacknight" <mi...@blacknight.ie>]

Have a look at MailScanner (http://www.mailscanner.info).
It has builtin phishing checks

Re: Anyone else getting slammed with eBay & PayPal Phising not getting tagged?

[Niek <ni...@asbak.coding-slaves.com>]

On 6/28/2005 9:49 PM +0200, Debbie D wrote:
> What rules can I add or tweak to stop these??

Over here, they always almost hit bayes_99, dcc and razor.
In about 50% of the cases, they hit some SARE (FRAUD i suppose) rule.
The SARE rules don't come in stock SA (http://www.rulesemporium.com)

Niek Baakman

Re: Anyone else getting slammed with eBay & PayPal Phising not getting tagged?

[Loren Wilton <lw...@earthlink.net>]

Usually it is the headers that catch these as obvious fakes.  However, there
are some SARE rules to look for some of the more obvious text tricks also.
Since you didn't include the headers for that message it is a little hard to
see what might have hit.

That said, between SARE rules and some local rules, I've had *one* phish
make it into my inbox in the last 9 months or so.  The text you post I've
commonly seen in one class of phish that gets caught well here, so it should
for you also.

        Loren