[Mimedefang] for mcafee lovers

Chris Gauch cgauch at digicon.net
Tue Mar 22 21:45:44 EST 2005


David Skoll wrote:

> > (Well, OK.  Some RP employees use Windoze at home, and I suppose they
> > might check their e-mail from home, so Clam probably is more useful
> > than I'm admitting... grumble grumble...)
> 
> My colleague Dave O'Neill pointed out that Clam has signatures
> against phishing attacks (which are platform-independent.)  It blocks
> about six per day for us.
> 
> Do any commercial AV scanners have phishing signatures?  If not, that's
> a very strong argument for Clam.

McAfee definitely has its own way of identifying "phishing" email, not
familiar enough with any other AV software.  

I've found that rejecting/discarding mail based on domain mismatch (domain
of sender is x.com and relay host domain is y.com, or better yet, the relay
is an IP address) for domains like ebay.com, citibank.com, and paypal.com is
very effective at stopping phishing attempts.  Combine that with AV software
and there's a very low probably of this stuff getting through to your mail
users.

As for "not running systems that systems that are susceptible to email
viruses", that's just job security ;-).  

- Chris




More information about the MIMEDefang mailing list