You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Sujit Acharyya-choudhury <s....@bbk.ac.uk> on 2015/08/11 13:11:56 UTC
Phishtank and SpamAssassin
I have seen lot of Phishes submitted in Phishtank.com and yet there is no
rule to check Phishtank.com. Would it be a good idea to give some points to
phishes submitted to phishtank - even if they are not verified?
RE: Phishtank and SpamAssassin
Posted by Sujit Acharyya-choudhury <s....@bbk.ac.uk>.
Unfortunately, most of the phishes are under many layers of the main domain.
Google, Web of Trust (WOT) and many other virus scanner seem to find it, as
was rightly pointed out SaneSecurity's signatures of Phishtank. So as far
as phishes we are getting, so far it has not being proved to be very useful,
even though some of them were in the wild for a while and Google and WOT
caught up with them.
-----Original Message-----
From: Reindl Harald [mailto:h.reindl@thelounge.net]
Sent: 11 August 2015 13:07
To: users@spamassassin.apache.org
Subject: Re: Phishtank and SpamAssassin
Am 11.08.2015 um 14:02 schrieb Sujit Acharyya-choudhury:
> The URIBL_PH_SURBL is actually not very useful. I have checked a real
> phishing site with SURBL and it shows clean in SURBL - I think, SURBL only
> looks at the part of the domain.
every URIBL check only tests the main-domain of a link, that's how it
works - you can't qualify something as "not very useful" because you
checked a single site
if you have a sensible RBL scoring in front of the contentscanner you
won't see much hits because mailservers sending the phishing crap are
instantly known and blocked
> -----Original Message-----
> From: RW [mailto:rwmaillists@googlemail.com]
> Sent: 11 August 2015 12:57
> To: users@spamassassin.apache.org
> Subject: Re: Phishtank and SpamAssassin
>
> On Tue, 11 Aug 2015 11:11:56 +0000
> Sujit Acharyya-choudhury wrote:
>
>> I have seen lot of Phishes submitted in Phishtank.com and yet there
>> is no rule to check Phishtank.com.
>
> There is via URIBL_PH_SURBL. It doesn't score much though
Re: Phishtank and SpamAssassin
Posted by Reindl Harald <h....@thelounge.net>.
Am 11.08.2015 um 14:02 schrieb Sujit Acharyya-choudhury:
> The URIBL_PH_SURBL is actually not very useful. I have checked a real
> phishing site with SURBL and it shows clean in SURBL - I think, SURBL only
> looks at the part of the domain.
every URIBL check only tests the main-domain of a link, that's how it
works - you can't qualify something as "not very useful" because you
checked a single site
if you have a sensible RBL scoring in front of the contentscanner you
won't see much hits because mailservers sending the phishing crap are
instantly known and blocked
> -----Original Message-----
> From: RW [mailto:rwmaillists@googlemail.com]
> Sent: 11 August 2015 12:57
> To: users@spamassassin.apache.org
> Subject: Re: Phishtank and SpamAssassin
>
> On Tue, 11 Aug 2015 11:11:56 +0000
> Sujit Acharyya-choudhury wrote:
>
>> I have seen lot of Phishes submitted in Phishtank.com and yet there
>> is no rule to check Phishtank.com.
>
> There is via URIBL_PH_SURBL. It doesn't score much though
Re: Phishtank and SpamAssassin
Posted by Raymond Dijkxhoorn <ra...@prolocation.net>.
Hai!
SURBL looks at the importance of the site. Is it lets for example a phishing page on a large isp we will not blacklist the whole isp. Too much collateral damage.
SURBL has also a non RBL product for this called UriQ. Specificly for full uri lookups (eg also hacked and phishing pages) that might be a good match for that problem but isnt available as a free product.
More information can be requested offlist.
Thanks,
Raymond Dijkxhoorn, SURBL.
> Op 11 aug. 2015 om 05:02 heeft Sujit Acharyya-choudhury <s....@bbk.ac.uk> het volgende geschreven:
>
> The URIBL_PH_SURBL is actually not very useful. I have checked a real
> phishing site with SURBL and it shows clean in SURBL - I think, SURBL only
> looks at the part of the domain.
>
> -----Original Message-----
> From: RW [mailto:rwmaillists@googlemail.com]
> Sent: 11 August 2015 12:57
> To: users@spamassassin.apache.org
> Subject: Re: Phishtank and SpamAssassin
>
> On Tue, 11 Aug 2015 11:11:56 +0000
> Sujit Acharyya-choudhury wrote:
>
>> I have seen lot of Phishes submitted in Phishtank.com and yet there
>> is no rule to check Phishtank.com.
>
> There is via URIBL_PH_SURBL. It doesn't score much though.
RE: Phishtank and SpamAssassin
Posted by Sujit Acharyya-choudhury <s....@bbk.ac.uk>.
The URIBL_PH_SURBL is actually not very useful. I have checked a real
phishing site with SURBL and it shows clean in SURBL - I think, SURBL only
looks at the part of the domain.
-----Original Message-----
From: RW [mailto:rwmaillists@googlemail.com]
Sent: 11 August 2015 12:57
To: users@spamassassin.apache.org
Subject: Re: Phishtank and SpamAssassin
On Tue, 11 Aug 2015 11:11:56 +0000
Sujit Acharyya-choudhury wrote:
> I have seen lot of Phishes submitted in Phishtank.com and yet there
> is no rule to check Phishtank.com.
There is via URIBL_PH_SURBL. It doesn't score much though.
Re: Phishtank and SpamAssassin
Posted by RW <rw...@googlemail.com>.
On Tue, 11 Aug 2015 11:11:56 +0000
Sujit Acharyya-choudhury wrote:
> I have seen lot of Phishes submitted in Phishtank.com and yet there
> is no rule to check Phishtank.com.
There is via URIBL_PH_SURBL. It doesn't score much though.
RE: Phishtank and SpamAssassin
Posted by Sujit Acharyya-choudhury <s....@bbk.ac.uk>.
Many thanks for the info.
-----Original Message-----
From: Reindl Harald [mailto:h.reindl@thelounge.net]
Sent: 11 August 2015 12:14
To: users@spamassassin.apache.org
Subject: Re: Phishtank and SpamAssassin
Am 11.08.2015 um 13:11 schrieb Sujit Acharyya-choudhury:
> I have seen lot of Phishes submitted in Phishtank.com and yet there is
> no rule to check Phishtank.com. Would it be a good idea to give some
> points to phishes submitted to phishtank - even if they are not verified?
that's way better placed in clamav then SA
http://sanesecurity.com/usage/signatures/
-rw-r--r-- 1 clamupdate clamupdate 3,7M 2015-08-11 12:46
/var/lib/clamav/phishtank.ndb
Re: Phishtank and SpamAssassin
Posted by Reindl Harald <h....@thelounge.net>.
Am 11.08.2015 um 13:11 schrieb Sujit Acharyya-choudhury:
> I have seen lot of Phishes submitted in Phishtank.com and yet there is
> no rule to check Phishtank.com. Would it be a good idea to give some
> points to phishes submitted to phishtank – even if they are not verified?
that's way better placed in clamav then SA
http://sanesecurity.com/usage/signatures/
-rw-r--r-- 1 clamupdate clamupdate 3,7M 2015-08-11 12:46
/var/lib/clamav/phishtank.ndb