spamassassin-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From David Jones <djo...@ena.com>
Subject Re: Invoice phish
Date Tue, 08 May 2018 20:44:58 GMT
On 05/08/2018 03:02 PM, Alex wrote:
> Hi,
> Does anyone have any special techniques for catching these invoice phish emails?
> 
> https://pastebin.com/raw/TfvhUu0X
> 
> I've added a few body rules, and even despite training previous
> similar messages as spam, they continue. These emails very closely
> resemble legitimate email regarding invoices that purchasing people
> fall for them all the time.
> 
> Senderscore greater than 90, and routed through O365.
> 
> The domain is no longer defined in DNS, but even the x-originating-ip
> is not currently listed on any RBL.
> 

I would also report that to SpamCop since that IP is Google's.

It's now listed on dnsbl.spfbl.net probably because of your original 
posting.  :)

-- 
David Jones

Mime
View raw message