I've a couple of fun ones at the moment. Basically I'm getting reports of 
phishing emails that get past everything.

The headers are like this:

Reply-to: Sender Name <n...@recipientdomain.tld-1.me>
To: recipi...@recipientdomain.tld
From: Sender Name <f...@domain.tld>
From: Sender Name <f...@domain2.tld>
From: Sender Name <actualsmtpfromaddr...@legitimatebutcompromiseddomain.tld>

These bypass no spoofing as none of the from/SMTP header domains are actually 
the recipient domain. Annoyingly, Outlook chooses the Reply-to address to 
display so it appears almost legitimate.

I'm aware that the RFCs allow multiple from headers, though I can't see of any 
legitimate reason for this so I was considering blocking or increasing spam 
score based on this - is this possible with ASSP at the moment or not?

The second thing I was looking at doing was coming up with a regex. 
Essentially, all recipient domains are in localdomains.txt so I'd want a regex 
that would take all lines from localdomains. If the reply to or smtp from 
address is a line from localdomains with anything else after it, then bin it. I 
accept that there may in some extremely obscure cases be a clash with a 
legitimate domain but do not believe that to be likely. I'll have a look next 
week as to if I can figure out a way to do it but if there's something obvious 
that you could let me know that'd be great.

All the best,
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
Assp-test mailing list

Reply via email to