Re: Detecting phishing urls

2006-01-30 Thread Loren Wilton
> I can write a regexp that looks for an address in the tag's body > that is different than in it's href, but I figured someone else had > already written one. Can someone point me in the right direction? I believe there are one or two in sare_fraud, but they aren't scored very high because they

Re: Detecting phishing urls

2006-01-30 Thread Theo Van Dinter
On Mon, Jan 30, 2006 at 05:10:42PM -0500, Dan wrote: > I was thinking of a regexp along the lines of: > /href=\"https?:\/\/[0-9]{1,3}(\.[0-9]{1,3}){3}[^>]+>http:\/\/\w/i > > It's not perfect, but it would detect the above scenerio. Yes and no. You'd have to do a rawbody, and it doesn't take into

Re: Detecting phishing urls

2006-01-30 Thread Dan
On 1/30/06, Theo Van Dinter <[EMAIL PROTECTED]> wrote: > On Mon, Jan 30, 2006 at 11:48:17AM -0500, Dan wrote: > > > href="http://123.123.123.123/fraud_uri";>http://amazon.com/official_looking_path > > I can write a regexp that looks for an address in the tag's body > > that is different than in i

Re: Detecting phishing urls

2006-01-30 Thread Theo Van Dinter
On Mon, Jan 30, 2006 at 11:48:17AM -0500, Dan wrote: > href="http://123.123.123.123/fraud_uri";>http://amazon.com/official_looking_path > I can write a regexp that looks for an address in the tag's body > that is different than in it's href, but I figured someone else had > already written one.

Detecting phishing urls

2006-01-30 Thread Dan
What is the best way to detect urls that have one address in the tag's href, but another in its body like the following example: http://123.123.123.123/fraud_uri";>http://amazon.com/official_looking_path I can write a regexp that looks for an address in the tag's body that is different than in