On Mon, 3 Dec 2018, Andreas Galatis wrote:
since several weeks I keep getting mails with sender-addresses like "Harald
Wieruch - Top Ten GmbH h.wieruch@top10ten.comxandra.hennem...@metco-gmbh.de"
The first part "Harald Wieruch - Top Ten GmbH h.wier...@top10ten.com" stays
the same, everything behind this address changes.
How comes that spamassassin doesn't block mailsenders with 2 @-signs in the
address?
Trivial answer: because there is no poison-pill rule for that being
published.
Is there any possibility to stop those mail, all of them having word- docs
attached, containing a trojan horse?
A rule can certainly be written for that, but if it doesn't occur in the
masscheck corpus then that rule won't be promoted and published.
Any help is very welcome
If you could post a spample to pastebin (modify the recipient address as
needed to maintain privacy, but don't change anything else) it would help
writing a rule that actually does match.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
...in the 2nd amendment the right to arms clause means you have
the right to choose how many arms you want, and the militia clause
means that Congress can punish you if the answer is "none."
-- David Hardy, 2nd Amendment scholar
-----------------------------------------------------------------------
4 days until The 77th anniversary of Pearl Harbor
