Re: Catch subtly-different Reply-To domain

2021-02-23 Thread Dominic Raferd
On 22/02/2021 15:45, Dominic Raferd wrote: On 22/02/2021 15:05, RW wrote: On Sun, 21 Feb 2021, Dominic Raferd wrote: Michael's suggestion is interesting. There is a github project allowing Levenshtein numbers to be calculated and used in SA, I will see if there is a way to apply it in this

Re: Catch subtly-different Reply-To domain

2021-02-22 Thread Dominic Raferd
On 22/02/2021 15:05, RW wrote: On Sun, 21 Feb 2021 16:32:01 -0800 (PST) John Hardin wrote: On Sun, 21 Feb 2021, John Hardin wrote: On Sun, 21 Feb 2021, Dominic Raferd wrote: Michael's suggestion is interesting. There is a github project allowing Levenshtein numbers to be calculated and

Re: Catch subtly-different Reply-To domain

2021-02-22 Thread John Hardin
On Mon, 22 Feb 2021, RW wrote: On Sun, 21 Feb 2021 16:32:01 -0800 (PST) John Hardin wrote: On Sun, 21 Feb 2021, John Hardin wrote: On Sun, 21 Feb 2021, Dominic Raferd wrote: Michael's suggestion is interesting. There is a github project allowing Levenshtein numbers to be calculated and

Re: Catch subtly-different Reply-To domain

2021-02-22 Thread RW
On Sun, 21 Feb 2021 16:32:01 -0800 (PST) John Hardin wrote: > On Sun, 21 Feb 2021, John Hardin wrote: > > > On Sun, 21 Feb 2021, Dominic Raferd wrote: > >> Michael's suggestion is interesting. There is a github project > >> allowing Levenshtein numbers to be calculated and used in SA, I > >>

Re: Catch subtly-different Reply-To domain

2021-02-21 Thread John Hardin
On Sun, 21 Feb 2021, John Hardin wrote: On Sun, 21 Feb 2021, Dominic Raferd wrote: On 21/02/2021 20:09, Benny Pedersen wrote: On 2021-02-21 19:44, Dominic Raferd wrote: Presumably interfacefm.com has been hacked, but not to the extent that they can intercept incoming replies. I stand

Re: Catch subtly-different Reply-To domain

2021-02-21 Thread John Hardin
On Sun, 21 Feb 2021, Dominic Raferd wrote: On 21/02/2021 20:09, Benny Pedersen wrote: On 2021-02-21 19:44, Dominic Raferd wrote: Presumably interfacefm.com has been hacked, but not to the extent that they can intercept incoming replies. I stand corrected; but as they specify p=none, the

Re: Catch subtly-different Reply-To domain

2021-02-21 Thread Benny Pedersen
On 2021-02-21 23:00, Dominic Raferd wrote: p=none is an instruction from the domain controller *not* to reject emails from their domain even when they fail DMARC testing. So the end result is that this mail should pass through DMARC testing. remember dmarc can pass on spf pass only, even if

Re: Catch subtly-different Reply-To domain

2021-02-21 Thread Dominic Raferd
On 21/02/2021 20:09, Benny Pedersen wrote: On 2021-02-21 19:44, Dominic Raferd wrote: Presumably interfacefm.com has been hacked, but not to the extent that they can intercept incoming replies. I stand corrected; but as they specify p=none, the mail must still pass. in what way should it

Re: Catch subtly-different Reply-To domain

2021-02-21 Thread Benny Pedersen
On 2021-02-21 19:44, Dominic Raferd wrote: Presumably interfacefm.com has been hacked, but not to the extent that they can intercept incoming replies. I stand corrected; but as they specify p=none, the mail must still pass. in what way should it pass ? dmarc tests spf, dkim, and opendmarc

Re: Catch subtly-different Reply-To domain

2021-02-21 Thread Dominic Raferd
On 21/02/2021 17:37, RW wrote: On Sun, 21 Feb 2021 17:00:32 + Dominic Raferd wrote: On 21/02/2021 16:20, Benny Pedersen wrote: On 2021-02-21 17:00, RW wrote: On Sun, 21 Feb 2021 14:04:20 + Dominic Raferd wrote: On 21/02/2021 13:56, RW wrote: From: "Karen Howard" Reply-To:

Re: Catch subtly-different Reply-To domain

2021-02-21 Thread RW
On Sun, 21 Feb 2021 17:00:32 + Dominic Raferd wrote: > On 21/02/2021 16:20, Benny Pedersen wrote: > > On 2021-02-21 17:00, RW wrote: > >> On Sun, 21 Feb 2021 14:04:20 + > >> Dominic Raferd wrote: > >> > >>> On 21/02/2021 13:56, RW wrote: > >> > >>> >>> From: "Karen Howard" > >>>

Re: Catch subtly-different Reply-To domain

2021-02-21 Thread Dominic Raferd
On 21/02/2021 16:20, Benny Pedersen wrote: On 2021-02-21 17:00, RW wrote: On Sun, 21 Feb 2021 14:04:20 + Dominic Raferd wrote: On 21/02/2021 13:56, RW wrote: >>> From: "Karen Howard" >>> Reply-To: "Karen Howard" Yes this mail passed DMARC How did it pass DMARC when it has the

Re: Catch subtly-different Reply-To domain

2021-02-21 Thread Benny Pedersen
On 2021-02-21 17:00, RW wrote: On Sun, 21 Feb 2021 14:04:20 + Dominic Raferd wrote: On 21/02/2021 13:56, RW wrote: >>> From: "Karen Howard" >>> Reply-To: "Karen Howard" Yes this mail passed DMARC How did it pass DMARC when it has the domain being spoofed in the from header?

Re: Catch subtly-different Reply-To domain

2021-02-21 Thread RW
On Sun, 21 Feb 2021 14:04:20 + Dominic Raferd wrote: > On 21/02/2021 13:56, RW wrote: > >>> From: "Karen Howard" > >>> Reply-To: "Karen Howard" > Yes this mail passed DMARC How did it pass DMARC when it has the domain being spoofed in the from header?

Re: Catch subtly-different Reply-To domain

2021-02-21 Thread Dominic Raferd
On 21/02/2021 13:56, RW wrote: On Sun, 21 Feb 2021 11:28:51 +0100 Michael Storz wrote: Am 2021-02-20 08:58, schrieb Dominic Raferd: Is there a rule to catch cases where the domain of the Reply-To header is a subtle variant on that in the To header. Take this (real) example from a phishing

Re: Catch subtly-different Reply-To domain

2021-02-21 Thread RW
On Sun, 21 Feb 2021 11:28:51 +0100 Michael Storz wrote: > Am 2021-02-20 08:58, schrieb Dominic Raferd: > > Is there a rule to catch cases where the domain of the Reply-To > > header is a subtle variant on that in the To header. Take this > > (real) example from a phishing email sent yesterday: >

Re: Catch subtly-different Reply-To domain

2021-02-21 Thread Michael Storz
Am 2021-02-20 08:58, schrieb Dominic Raferd: Is there a rule to catch cases where the domain of the Reply-To header is a subtle variant on that in the To header. Take this (real) example from a phishing email sent yesterday: From: "Karen Howard" Reply-To: "Karen Howard" I realise that other

Catch subtly-different Reply-To domain

2021-02-19 Thread Dominic Raferd
Is there a rule to catch cases where the domain of the Reply-To header is a subtle variant on that in the To header. Take this (real) example from a phishing email sent yesterday: From: "Karen Howard" Reply-To: "Karen Howard" I realise that other elements of the address can be different