Re: More outlook phish

2018-06-08 Thread Rupert Gallagher
On Fri, Jun 8, 2018 at 23:05, David Jones wrote: > 2.2 MISSING_HEADERS Missing To: header The fillowing is all one needs. 5.0 MISSING_HEADERS Missing To: header Remember that e-mail is mail after all.

Re: More outlook phish

2018-06-08 Thread John Hardin
On Fri, 8 Jun 2018, Grant Taylor wrote: On 06/08/2018 05:36 PM, RW wrote: It can be done if you capture inside a lookahead. For example: Intriguing. Indeed. body X_EQUALS_Y /^(?=.*X=(\d+)\b).*Y=\1\b/ Can I ask that you unpack that Regular Expression? Please. I'm apparently too rust

Re: More outlook phish

2018-06-08 Thread Grant Taylor
On 06/08/2018 05:36 PM, RW wrote: It can be done if you capture inside a lookahead. For example: Intriguing. body X_EQUALS_Y /^(?=.*X=(\d+)\b).*Y=\1\b/ Can I ask that you unpack that Regular Expression? Please. I'm apparently too rusty to unpack it myself. will match on the strings

Re: More outlook phish

2018-06-08 Thread RW
On Fri, 8 Jun 2018 13:38:47 -0700 (PDT) John Hardin wrote: > On Fri, 8 Jun 2018, Alex wrote: > > > Is a plugin necessary to tag on when the Subject matches content in > > the From? > > No, you can do a header rule that matches multiple headers that way. > The problem is there's no guarantee th

Re: More outlook phish

2018-06-08 Thread Alex
Hi, > 2.2 ENA_DIGEST_FREEMAILFreemail account hitting message digest spam It didn't hit any digests when it was received. > Reminder that I treat all senders on Office 365 as FREEMAIL (commonly abused > senders) which gets penalized with meta rules to amplify many scores. If > something co

Re: More outlook phish

2018-06-08 Thread David Jones
On 06/08/2018 03:17 PM, Alex wrote: Hi, Received this one today that was delivered to about 25 recipients, lacked a To header, routed through outlook.com and contained a link to a Google Drive doc that's still active. https://pastebin.com/y1k0LtM1 It was done under the pretense of a ShareFile

Re: More outlook phish

2018-06-08 Thread Rupert Gallagher
You did well in noting the lack of the To header. Just raise its score to 5.0. Sent from ProtonMail Mobile On Fri, Jun 8, 2018 at 22:17, Alex wrote: > Hi, Received this one today that was delivered to about 25 recipients, lacked > a To header, routed through outlook.com and contained a link to

Re: More outlook phish

2018-06-08 Thread John Hardin
On Fri, 8 Jun 2018, Alex wrote: Is a plugin necessary to tag on when the Subject matches content in the From? No, you can do a header rule that matches multiple headers that way. The problem is there's no guarantee the order the headers appear, so it would require multiple rules or have inco

More outlook phish

2018-06-08 Thread Alex
Hi, Received this one today that was delivered to about 25 recipients, lacked a To header, routed through outlook.com and contained a link to a Google Drive doc that's still active. https://pastebin.com/y1k0LtM1 It was done under the pretense of a ShareFile attachment. Is a plugin necessary to