On Tuesday, June 3, 2008, 10:31:43 AM, Joseph Brennan wrote:
> --On Tuesday, June 3, 2008 9:32 -0700 Kelson <[EMAIL PROTECTED]> wrote: >> Marc Perkel wrote: >>> If the FCrDNS matches one of these domains it is ham. >>> If the sender or from address matches one of these domains and the >>> domain doesn't appear in the Received headers - it's a phish. >>> <snip> >>> citibank.com >> >> It's worth noting that Citibank still sometimes uses other domains. I've >> seen legit mail from them that uses a citibank.com address, but is sent >> from a citigroup.com server. > Many banks also send mail from third-party servers. Bank of America > sends from customercenter.com and par3.com. American Express sends > from aexp.com (which is theirs) and cheetahmail.com. Some send from > bigfoot. It's only personal bank account information-- why keep the > data in-house? :-) Presumably you mean customercenter.net, owned by Checkfree. customercenter.com appears to be owned by domainers/squatters. Jeff C. -- Jeff Chan mailto:[EMAIL PROTECTED] http://www.surbl.org/
