Re: Response to phishing e-mails

[Joel Anderson <joela () UMN EDU>]

We absolutely encourage these reports - we even have a special email "
phishing () umn edu" to receive the messages. This puts them in a special
queue *and* gets a custom reply thanking and telling them how to give
message headers (in case they didnt'). We block email replies, divert DNS
to form pages as well as thanking the informants. In addition, we seed
information into forms to discover where attackers are coming from if
(when!) they are successful. I just put out a SANS paper on this process.

-- 
--
   ---------------------------------------------------
   joel anderson * joela () umn edu *  @joelpetera
   -->  612-625-7389  --> pager: 612-648-6823
   Security Coordinator
   University Information Security - University of Minnesota