spamassassin-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From John Schmerold <>
Subject encoded from
Date Sun, 11 Aug 2019 03:00:08 GMT
Evil doers go to our website, identify the leader, then start phishing. 
We have been blocking this by looking for the leader's name in the 
"From" field, today a number of phishes passed through our security 
filter, when I looked at the headers, I understood why, the bandits are 
using this:

F From: =?UTF-8?B?QW5keSAgQnJ5YW4=?= <>

Outlook shows the leader's name ("Andy Bryan"), Spamassassin does not. 
Any ideas how we can protect our users from this one?

My first inclination is something like this:

score    LOCAL__H_from_encode 5.00
header   LOCAL__H_from_encode From =~ /UTF\-/i

John Schmerold
Katy Computer Systems, Inc
St Louis

View raw message