Re: Blocking cannibalized spam/virus mail with password-protected attachments
Marco <[email protected]>
| Newsgroups | gmane.mail.virus.amavis.user |
|---|---|
| Message-ID | <[email protected]> |
Il 22/12/2020 09:39, Nikolaos Milas has written:
> On 22/12/2020 10:24 π.μ., Nikolaos Milas wrote:
>
>> Can you please suggest ways in which we can configure amavis so as to
>> recognize and drop this kind of mail?
>
> Another, probably better, approach would be to add to amavis a scan rule
> like:
>
> If body contains text like:
>
> Password archivio: XXXX
> -or-
> Archive pass: XXXX
>
> [where XXXX is a 3- or 4-digit number]
Hello,
during many years I didn't find a valid solution yet.
If you write a rule, you should update the rule for every variant. They
change frequently.
If you block the encrypted content some customer will complain.
I'm trying the bodyre hashbl rule approach: I hash the content ("pass:
XXX") and I put it on a local DNSBL. It's easier for me.
Warm Regards
Marco