On Sat, 13 Oct 2018 11:40:21 +0200 Daniele Duca wrote: > On 12/10/2018 23:12, Pedro David Marco wrote: > > > > > > > >On Friday, October 12, 2018, 10:48:21 PM GMT+2, Rupert Gallagher > > <r...@protonmail.com> wrote: > > > > >I love outlook.com ... > > > > i have seen recently an Office365 Phishing campaign coming from > > Office365 severs... as good as it gets... > > > It may be already known, but O365 does some outbound spam filtering > and adds some interesting headers on every email. It also uses > different IP pools for outbound emails that it thinks are spam: > https://docs.microsoft.com/en-us/office365/SecurityCompliance/anti-spam-message-headers > > I personally check the X-Forefront-Antispam-Report header for the > string "SFV:SPM" and bump the score accordingly.
I was looking at some examples of this in my spam corpus, and it looks like there was a rule for this until about a year ago: * 2.8 AXB_X_FF_SEZ_S Forefront sez this is spam
