Saying no to PayPal Phishing Attacks

Users on my mail server, well at least the ones with domains subscribed to the filtering service, no longer receive PayPal spoofs unaltered! The trick to catching this vermin is both simple and accurate.

An e-mail is certainly a phishing attack when all three of the following conditions are met:

Similar rules can be applied to,, and any of the other brands that are spoofed. The code has already been written and these rules are easily implemented with SpamAssassin and available at

Instead of the offending message being delivered unmarked to users who may be tricked by the scams, the users receive an e-mail stating that the message is suspected spam, giving enumerated reasons. Users can of course still see the original e-mail that is attached to the explanation message.

I wonder why the “Anti-Phishing Working Group” does not provide useful information like this. I suspect the next useful feature would be automatic reporting to or similar addresses that may be maintained by organizations who are victims of phishing scams.