Could you please extend the advisory function to find fishing e-mail with suspicious link.
For example , the e-mail is html formatted and if it has link with different address like below
<a href="http://www.fishingsite.com/">http://www.bank.com/</a>
This should be suspicious e-mail because it has different link between displayed URL and the really linked URL.
This should be treated as suspicious e-mail, and it should be displayed without html formatted.
Best regards,