Re: Process of domain submission for inclusion in 60_whitelist_auth.cf

2021-07-01 Thread Martin Gregorie
On Thu, 2021-07-01 at 16:32 -0600, @lbutlr wrote: > Sending spam, viruses, ransom demands, and/or spearfishing from > "known" addresses is extremely common, so how effective that is > depends a lot on the sort of mail and the amount of mail you receive. > Agreed, but I'm not silly enough to have t

Re: Process of domain submission for inclusion in 60_whitelist_auth.cf

2021-07-01 Thread @lbutlr
On 01 Jul 2021, at 16:43, Reindl Harald wrote: > Am 02.07.21 um 00:32 schrieb @lbutlr: >>> I also manually maintain a private blacklist, which contains the 'From' >>> addresses of advertising e-mails from companies that I've dealt with in >>> the past. This works because many (most?) companies use

Re: Office phish

2021-07-01 Thread Alex
Hi, > >> I realize blocking all javascript is prone to error, > > What legitimate email uses javascript? > And more important: which email clients do actually process Javascript > that comes within an email? Thunderbird doesn't since 10 or 20 years > ago. I don't know of any other as well. This ph

Re: Process of domain submission for inclusion in 60_whitelist_auth.cf

2021-07-01 Thread @lbutlr
On 29 Jun 2021, at 04:50, Martin Gregorie wrote: > On Tue, 2021-06-29 at 00:52 -0400, Bill Cole wrote: >> On 2021-06-28 at 17:04:05 UTC-0400 (Mon, 28 Jun 2021 23:04:05 +0200) >> Robert Harnischmacher >> is rumored to have said: >>> In which form can one submit the subdomain of a mail sender for

Re: Office phish

2021-07-01 Thread Alex Woick
I realize blocking all javascript is prone to error, What legitimate email uses javascript? And more important: which email clients do actually process Javascript that comes within an email? Thunderbird doesn't since 10 or 20 years ago. I don't know of any other as well. This phish is probab

Re: Office phish

2021-07-01 Thread RW
On Thu, 01 Jul 2021 18:40:04 +0100 Martin Gregorie wrote: > On Thu, 2021-07-01 at 18:59 +0200, Benny Pedersen wrote: > > On 2021-07-01 17:03, RW wrote: > > > > > > I realize blocking all javascript is prone to error, > > > What legitimate email uses javascript? > > > > and what mua will sh

Re: Office phish

2021-07-01 Thread Martin Gregorie
On Thu, 2021-07-01 at 18:59 +0200, Benny Pedersen wrote: > On 2021-07-01 17:03, RW wrote: > > > > I realize blocking all javascript is prone to error, > > What legitimate email uses javascript? > > and what mua will show html attachment as default ? Evolution is as configurable as any MUA I've u

Re: Office phish

2021-07-01 Thread Benny Pedersen
On 2021-06-30 21:51, Alex wrote: Hi, Would anyone like to help me block this office phish? It includes an HTML file that presents an O365 login page: https://pastebin.com/JMSrY6KU More javascript in an HTML file. # put this content into a file name "local_html.cdb" in clamav database dir Sa

Re: Office phish

2021-07-01 Thread Benny Pedersen
On 2021-07-01 17:42, Henrik K wrote: John's already done something that hits: mimeheader T_OBFU_HTML_ATTACHContent-Type =~ m,\bapplication/octet-stream\b.+\.html?\b,i Maybe that along with checking for very short body etc. add htmltidy to extract text plugin would also solve it, perl t

Re: Office phish

2021-07-01 Thread Benny Pedersen
On 2021-07-01 17:03, RW wrote: I realize blocking all javascript is prone to error, What legitimate email uses javascript? and what mua will show html attachment as default ?

Re: Office phish

2021-07-01 Thread Henrik K
On Thu, Jul 01, 2021 at 08:42:01AM -0400, Alex wrote: > Hi, > > > > I modified the ExtractText plugin to also process HTML files > > > > > > extracttext_externalhtmlcat /usr/bin/cat {} > > > extracttext_use htmlcat .htm .html > > > > > > > Quite horrible hack, as the result should be

Re: Office phish

2021-07-01 Thread RW
On Thu, 1 Jul 2021 08:42:01 -0400 Alex wrote: > I realize blocking all javascript is prone to error, What legitimate email uses javascript?

Re: Office phish

2021-07-01 Thread Matus UHLAR - fantomas
On 30.06.21 23:05, Bert Van de Poel wrote: SpamAssassin has plugins for PhishTank and OpenPhish. I would suggest you submit the link to them. You can also reach out to the domain provider, hosting provider(s) and other companies involved. don't you mean clamav instead? On 30/06/2021 21:51, A

Re: Office phish

2021-07-01 Thread Alex
Hi, > > I modified the ExtractText plugin to also process HTML files > > > > extracttext_externalhtmlcat /usr/bin/cat {} > > extracttext_use htmlcat .htm .html > > > > Quite horrible hack, as the result should be _rendered_ text. Inserting raw > HTML for all body rules is probably b