On 5/5/2010 5:05 PM, Karsten Bräckelmann wrote:
Please send us a ham sample. Obfuscating identifying data is ok, but
please keep it to a minimum needed, and make it obvious. Raw message
attached preferred. Feel free to send it directly to me and/or Justin,
rather than the list. Thanks!
Will do.
For reference, here is a phishing email, intact.
Note that the only body difference is the a href.
Everything else is exactly the same. (well, source isn't the same..
http://secnap.pastebin.com/yScdTeCv
__
This email has been
2010/5/6 Karsten Bräckelmann :
> On Wed, 2010-05-05 at 15:39 -0700, Kelson Vibber wrote:
>> We're seeing FPs Twitter's "So-and-so is now following you on Twitter"
>> notices, pushed over by JM_SOUGHT_3's 4 points. It appears to be
>> matching on __SEEK_O1OO80, which contains a large chunk of Twitt
On Wed, 2010-05-05 at 15:39 -0700, Kelson Vibber wrote:
> We're seeing FPs Twitter's "So-and-so is now following you on Twitter"
> notices, pushed over by JM_SOUGHT_3's 4 points. It appears to be
> matching on __SEEK_O1OO80, which contains a large chunk of Twitter's
> email footer.
>
> If I we
