Thorvald,
ClamAV's Phishing heuristics checks the link URL versus the URL listed in
the link text. Here is a simple example:
<a href="link">text</a>
If the text is formatted like a URL and it is different from the href link,
then it will be flagged as a phishing attempt. I don't know offhand how
different the link vs the text has to be to get flagged. I do know that if
it looks like the user is being redirected to a completely different domain
then it will be flagged (unless, as Steve pointed out, these domains are in
the daily.wdb whitelist database).
Here is what ClamAV is saying is a phishing attempt.
www.bankofamerica.co.uk:youraccount.mbna.co.uk/
Here is a WDB whitelist signature that should fix the problem:
M:www.bankofamerica.co.uk:youraccount.mbna.co.uk
he section of the phishsigs_howto.pdf that will help with this problem is
Section 1.3 WDB format. For this sig, the 'M' is going to be a direct match
for the hostname or subdomain. 'X' can be used for regular expressions that
will match an entire URL. Take a look at the daily.wdb for examples.
Also, if you get a chance, please submit this to the FP list. If I have a
specific example, I'll be able to update the official daily.wdb whitelist.
Hope this has helped. Please let me know if you have any follow-up
questions.
Thanks,
Shaun Hurley
On Tue, Sep 23, 2014 at 8:29 AM, Thorvald Hallvardsson <
thorvald.hallvards...@gmail.com> wrote:
> Hi Steve,
>
> Thank you for your answer. If I would like to build my own database (I have
> read PDF but I don't understand really how it works) what would be the
> syntax for it ?
>
> H:youraccount.mbna.co.uk:mbna.co.uk ??
>
> Regards.
>
> On 23 September 2014 13:08, Steve Basford <steveb_cla...@sanesecurity.com>
> wrote:
>
> >
> > On Tue, September 23, 2014 12:44 pm, Thorvald Hallvardsson wrote:
> >
> > > Anyone would like to point me into the right direction and help me out
> > > with the problems I'm having ?
> >
> > Report as an FPs here:
> >
> > http://cgi.clamav.net/sendvirus.cgi
> >
> > ClamAV team will need to add hosts to the daily.wdb database to
> > whitelist...
> >
> > eg... currently...
> >
> > grep "mbna" daily.wdb
> > M:customerservice.mbna.co.uk:virginmoney.com
> >
> > grep "bankof" daily.wdb
> > M:email.countrywide.com:www.bankofamerica.com
> > M:rc.us-east.srv.overture.com:www.bankofamerica.com
> >
> >
> > Cheers,
> >
> > Steve
> > Sanesecurity.com
> >
> > _______________________________________________
> > Help us build a comprehensive ClamAV guide:
> > https://github.com/vrtadmin/clamav-faq
> >
> > http://www.clamav.net/contact.html#ml
> >
> _______________________________________________
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml
>
_______________________________________________
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml
