[sanesecurity] Re: Scamnailer - FP? - rgu.ac.uk
- From: Henrik K <hege@xxxxxxx>
- To: sanesecurity@xxxxxxxxxxxxx
- Date: Mon, 15 Feb 2010 16:32:17 +0200
On Mon, Feb 15, 2010 at 01:39:31PM -0000, Steve Basford wrote:
> > Hello,
> >
> > We are getting a few false-positives with the scamnailer signature
> > 'ScamNailer.Phish.d.banks_AT_rgu.ac.uk'. A message is being sent to
> > several UK academic sites (it could well be some sort of local mailing
> > list), and included in the header To: field is the address d.banks @
> > rgu.ac.uk.
>
> Hi,
>
> ScamMailer and spear.ndb use this feed from APER...
>
> http://code.google.com/p/anti-phishing-email-reply/
>
> As you can see, they have this address listed:
>
> d.banks AT rgu.ac.uk,B,20090313
I vote to ignore all emails older than 3 months or so in the default
SaneSecurity files. Seems kinda pointless to list older..
Other related posts:
