On Tuesday July 25 2006 21:20, you wrote:
> Meni
>
> Sorry I didn't get back to you sooner, had company this weekend and just
> got back into the office today. Anyway I will be looking at the
> libphish C Library and my thought was to utilize that to create a web
> service for our Shazou plug-in and other related applications for
> anti-phishing. We are looking to extend Shazou's features to check
> against the db for Phishing scheme's when you bring up the Map, GeoIP
> and Whois data (We are adding Whois Lookup display in our next
> release). My overall goal is to warn users if the site they are on is
> reported in the Phishing DB and allow them someway to submit Phish.
Sounds like a good idea. You are welcome to use the libphish library under the
terms of its license. If you have any questions, don't hesitate to ask me.
> As for submitting a site for Phishing, instead of trying to maintain our
> own DB, I figure it would be best to partner up with you guys. Do you
> have a method or way in which we could report Phish via Shazou to you,
> is that something we could setup. Our Shazou plug-in is mainly a
Yes, there is a method to report sites as Phishing. First of all users can
use "Report As Phishing" from their anti-phishing toolbar (like FirePhish)
through their browser. It uses a script on our server which presents the user
with a form where they can add their comments (like what site it's attempting
to phish), and then it gets submitted to our review.
For example:
http://opdb.berlios.de/cgi-bin/report.pl?url=http://barclays10.net/olb/r/LoginMember.pl
> We also have some other solutions that we are developing some govt
> agencies based around cybercrime, so we may also have a way to work with
> you guys to get you official phish sites based on investigations or
> things that the govt would like to have known to protect the public.
> This could be a source of data that we can feed to you.
We will be glad if you will be able to provide reports on phishing sites,
preferably using the method shown above.
> My big question is are you guys checking out all submitted link to make
> sure they are actual phishing scheme's versus someone accidentally
> submitting or submitting their friends sites as joke or competitor sites??.
Yes, all sites reported by users get reviewed by us through an online
interface. Currently there are two more people, other than me, helping with
the review. We only add sites to the actual database after we make sure it's
indeed phishing.
> Anyway my next step is in the next day our two to check out your
> libphish api.
Regards.
--
Meni Livne <livne@xxxxxxx>
|
