You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Rajesh M <24...@24x7server.net> on 2017/08/28 03:24:07 UTC
block phishing spam
hi
we are constantly getting spam which has the following in the body of the email
dear user@domain.com
where user@domain.com is the mailto email id ie our customer's email id
is there a way to mark emails containing the mailto email id in the body of the email as spam ?
normal email communications never has such a scenario.
rajesh
Re: block phishing spam
Posted by Merijn van den Kroonenberg <me...@web2all.nl>.
> hi
>
> we are constantly getting spam which has the following in the body of the
> email
>
> dear user@domain.com
>
> where user@domain.com is the mailto email id ie our customer's email id
>
> is there a way to mark emails containing the mailto email id in the body
> of the email as spam ?
>
> normal email communications never has such a scenario.
Except for the very common scenario where someone replies to a message
from your customer. The customers e-mail address will be in the signature
or in the headers of the original message which are usually put in the
body when replying.
>
> rajesh
>
>
Re: block phishing spam
Posted by Merijn van den Kroonenberg <me...@web2all.nl>.
> On 08/27/2017 10:24 PM, Rajesh M wrote:
>> hi
>>
>> we are constantly getting spam which has the following in the body of
>> the email
>>
>> dear user@domain.com
>>
>> where user@domain.com is the mailto email id ie our customer's email id
>>
>> is there a way to mark emails containing the mailto email id in the body
>> of the email as spam ?
>>
>> normal email communications never has such a scenario.
>>
>> rajesh
>>
>
> body DEAR_MYDOMAIN /Dear .{1,30}\@domain\.com/i
> describe DEAR_MYDOMAIN Body contains Dear user@domain.com
> score DEAR_MYDOMAIN 1.0
Actually, it could probably be made more generic into tagging "Dear
email-address".
body DEAR_EMAIL /Dear\s+.{1,30}\@\S{1,30}\.\w{2,10}/i
describe DEAR_EMAIL Body contains Dear user@domain.tld
score DEAR_EMAIL 1.0
(untested)
>
> --
> David Jones
>
Re: block phishing spam
Posted by David Jones <dj...@ena.com>.
On 08/27/2017 10:24 PM, Rajesh M wrote:
> hi
>
> we are constantly getting spam which has the following in the body of the email
>
> dear user@domain.com
>
> where user@domain.com is the mailto email id ie our customer's email id
>
> is there a way to mark emails containing the mailto email id in the body of the email as spam ?
>
> normal email communications never has such a scenario.
>
> rajesh
>
body DEAR_MYDOMAIN /Dear .{1,30}\@domain\.com/i
describe DEAR_MYDOMAIN Body contains Dear user@domain.com
score DEAR_MYDOMAIN 1.0
--
David Jones