Re: fake URL's in mail

2011-03-28 Thread Adam Katz
On 03/25/2011 04:59 AM, Matus UHLAR - fantomas wrote: > Are there REALLY that MANY massmailers that can not post > valid URL's? Something is rotten in the state od Denmark... Yes. Here is an example of ham in this category (obfuscated from an opt-in newsletter I received a few days ago): > .. yo

Re: fake URL's in mail

2011-03-25 Thread Matus UHLAR - fantomas
> On 23/03/2011 4:36 PM, Adam Katz wrote: >> That would require an ENORMOUS whitelist and very close attention to its >> upkeep. I do not see this as practical without using a URIBL-style >> mechanism (which would also require high maintenance). >> Even with such a >> mechanism in place, it undul

Re: fake URL's in mail

2011-03-25 Thread Matus UHLAR - fantomas
> >> On 03/21/2011 09:37 AM, Matus UHLAR - fantomas wrote: > > Does anyone successfully use plugin or at least rules that > > catch fake URLs? > On 03/23/2011 11:43 AM, Matus UHLAR - fantomas wrote: > > I know about the problem with "legal" mail and spoofed URL's. That's > > why I asked ab

Re: fake URL's in mail

2011-03-23 Thread Lawrence @ Rogers
On 23/03/2011 4:36 PM, Adam Katz wrote: On 03/23/2011 11:43 AM, Matus UHLAR - fantomas wrote: On 03/21/2011 09:37 AM, Matus UHLAR - fantomas wrote: Does anyone successfully use plugin or at least rules that catch fake URLs? On 21.03.11 13:36, Adam Katz wrote: __SPOOFED_URL, a rule already shi

Re: fake URL's in mail

2011-03-23 Thread Adam Katz
On 03/23/2011 11:43 AM, Matus UHLAR - fantomas wrote: >> On 03/21/2011 09:37 AM, Matus UHLAR - fantomas wrote: > Does anyone successfully use plugin or at least rules that > catch fake URLs? > On 21.03.11 13:36, Adam Katz wrote: >> __SPOOFED_URL, a rule already shipping with SA, does this.

Re: fake URL's in mail

2011-03-23 Thread Michael Scheidell
On 3/23/11 2:50 PM, Matus UHLAR - fantomas wrote: On 3/23/11 2:43 PM, Matus UHLAR - fantomas wrote: I know about the problem with "legal" mail and spoofed URL's. That's why I asked about plugin that would be able to accept whitelists. I don't see if it's possible to combine this with matching s

Re: fake URL's in mail

2011-03-23 Thread Matus UHLAR - fantomas
> On 3/23/11 2:43 PM, Matus UHLAR - fantomas wrote: >> I know about the problem with "legal" mail and spoofed URL's. That's why I >> asked about plugin that would be able to accept whitelists. >> >> I don't see if it's possible to combine this with matching some domains >> while not matching others

Re: fake URL's in mail

2011-03-23 Thread Michael Scheidell
On 3/23/11 2:43 PM, Matus UHLAR - fantomas wrote: I know about the problem with "legal" mail and spoofed URL's. That's why I asked about plugin that would be able to accept whitelists. I don't see if it's possible to combine this with matching some domains while not matching others, e.g. allow

Re: fake URL's in mail

2011-03-23 Thread Matus UHLAR - fantomas
> On 03/21/2011 09:37 AM, Matus UHLAR - fantomas wrote: > >>> Does anyone successfully use plugin or at least rules that catch > >>> fake URLs? > > > I mean URLs pointing to different address than they appear, like: > > > > http://webmail.example.com/ On 21.03.11 13:36, Adam Katz wrote: > No plu

Re: fake URL's in mail

2011-03-21 Thread Adam Katz
On 03/21/2011 09:37 AM, Matus UHLAR - fantomas wrote: >>> Does anyone successfully use plugin or at least rules that catch >>> fake URLs? > I mean URLs pointing to different address than they appear, like: > > http://webmail.example.com/ No plugin needed. __SPOOFED_URL, a rule already shipping

Re: fake URL's in mail

2011-03-21 Thread Michael Scheidell
On 3/21/11 12:57 PM, Matus UHLAR - fantomas wrote: I use clamav, it somehow doesn't catch them all. as I have already said, many banks send URL's that do not match, so this is not possible to implement genreally (Yes, I know it sucks). with clamav, you can set up a whitelist. do a 'clamconf'

Re: fake URL's in mail

2011-03-21 Thread Anthony Cartmell
Does anyone successfully use plugin or at least rules that catch fake URLs? On 3/21/11 12:37 PM, Matus UHLAR - fantomas wrote: I mean URLs pointing to different address than they appear, like: http://webmail.example.com/ On 21.03.11 12:41, Michael Scheidell wrote: CLAMAV. I use clamav, i

Re: fake URL's in mail

2011-03-21 Thread Matus UHLAR - fantomas
>>> On 2011/03/21 12:18 PM, Matus UHLAR - fantomas wrote: Does anyone successfully use plugin or at least rules that catch fake URLs? > On 3/21/11 12:37 PM, Matus UHLAR - fantomas wrote: >> I mean URLs pointing to different address than they appear, like: >> >> http://webmail.example.com

Re: fake URL's in mail

2011-03-21 Thread Michael Scheidell
On 3/21/11 12:37 PM, Matus UHLAR - fantomas wrote: On 21.03.11 12:27, Jason Bertoch wrote: On 2011/03/21 12:18 PM, Matus UHLAR - fantomas wrote: Does anyone successfully use plugin or at least rules that catch fake URLs? Fake URLs? Do you mean URL obfuscators/redirectors like bit . ly and tin

Re: fake URL's in mail

2011-03-21 Thread Matus UHLAR - fantomas
On 21.03.11 12:27, Jason Bertoch wrote: > On 2011/03/21 12:18 PM, Matus UHLAR - fantomas wrote: >> Does anyone successfully use plugin or at least rules that catch fake URLs? > > Fake URLs? Do you mean URL obfuscators/redirectors like bit . ly and > tiny url . com? Ah, no. I mean URLs pointing

Re: fake URL's in mail

2011-03-21 Thread Jason Bertoch
On 2011/03/21 12:18 PM, Matus UHLAR - fantomas wrote: Does anyone successfully use plugin or at least rules that catch fake URLs? Fake URLs? Do you mean URL obfuscators/redirectors like bit . ly and tiny url . com? If so, I've had considerable success with Steve Freegard's DecodeShortURLs p

fake URL's in mail

2011-03-21 Thread Matus UHLAR - fantomas
Hello, I know that this discussion took many place here in the past, but our company is a victim of many phishing attacks so I would like to use any possible solution. My idea is that, while there are many many companies sending liegitimate mail with fake URLs, but those could be whitelisted in a