Re: block emails with fake FROM

2022-06-24 Thread Matus UHLAR - fantomas
seems it did not catch this one: From: " Dr Perfect "@mail.gepesdaru.hu but still it's a leap forward On 24.06.22 08:12, Alex wrote: Is it designed to also identify From addresses that have no name component? From: l...@beroe-inc.com I guess this one is correct via RC5321 This is an

Re: block emails with fake FROM

2022-06-24 Thread Alex
Hi, seems it did not catch this one: > > From: " Dr Perfect "@mail.gepesdaru.hu > > but still it's a leap forward > Is it designed to also identify From addresses that have no name component? From: l...@beroe-inc.com This is an invoice phish that isn't tagged. Ideas on how to block these

Re: block emails with fake FROM

2022-06-23 Thread Benny Pedersen
On 2022-06-23 18:08, Matus UHLAR - fantomas wrote: 2 - /etc/spamassassin/local.cf header LOCAL_FROMNAME_SPOOF eval:check_fromname_spoof() score LOCAL_FROMNAME_SPOOF 5.0 My question is about how to configure this plugin and also which score i should give on the new rules ? you have just

Re: block emails with fake FROM

2022-06-23 Thread Matus UHLAR - fantomas
On 23.06.22 15:56, Eduardo Maia wrote: I'm trying to block the emails with fake FROM like: From: "Nick Blue " I have installed spamassassin  v3.4.6 and after I enabled the FromNameSpoof plugin. On 23.06.22 18:08, Matus UHLAR - fantomas wrote: I have checked FromNameSpoof plug

Re: block emails with fake FROM

2022-06-23 Thread Matus UHLAR - fantomas
On 23.06.22 15:56, Eduardo Maia wrote: I'm trying to block the emails with fake FROM like: From: "Nick Blue " I have installed spamassassin  v3.4.6 and after I enabled the FromNameSpoof plugin. I have checked FromNameSpoof plugin from SA 3.4.6 and it does not detect

Re: block emails with fake FROM

2022-06-23 Thread Benny Pedersen
On 2022-06-23 16:56, Eduardo Maia wrote: From: "Nick Blue " header FOO From:Name =~ /\b@/ others may refine it :=) note From:Addr must accept more then one @, but not From:Name i dont know if the plugin is better or not, also remember dkim revails bogus adressing, eq no dkim pass if

block emails with fake FROM

2022-06-23 Thread Eduardo Maia
Hi, I'm trying to block the emails with fake FROM like: From: "Nick Blue " I have installed spamassassin  v3.4.6 and after I enabled the FromNameSpoof plugin. I added the following lines on the files: 1- /etc/spamassassin/v342.pre : loadplugin Mail::SpamAssassin::Plugin::Fro