spamassassin-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Jeff Chan <je...@surbl.org>
Subject Re: List of Banks often spoofed in Phishing scams
Date Wed, 04 Jun 2008 15:08:02 GMT
On Tuesday, June 3, 2008, 10:31:43 AM, Joseph Brennan wrote:


> --On Tuesday, June 3, 2008 9:32 -0700 Kelson <kelson@speed.net> wrote:

>> Marc Perkel wrote:
>>> If the FCrDNS matches one of these domains it is ham.
>>> If the sender or from address matches one of these domains and the
>>> domain doesn't appear in the Received headers - it's a phish.
>>> <snip>
>>> citibank.com
>>
>> It's worth noting that Citibank still sometimes uses other domains. I've
>> seen legit mail from them that uses a citibank.com address, but is sent
>> from a citigroup.com server.


> Many banks also send mail from third-party servers.  Bank of America
> sends from customercenter.com and par3.com.  American Express sends
> from aexp.com (which is theirs) and cheetahmail.com.  Some send from
> bigfoot.  It's only personal bank account information-- why keep the
> data in-house?  :-)

Presumably you mean customercenter.net, owned by Checkfree.
customercenter.com appears to be owned by domainers/squatters.

Jeff C.
-- 
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/


Mime
View raw message