Skip to content

Instantly share code, notes, and snippets.

@hojendiz

hojendiz/local.cf

Last active February 7, 2019 13:51
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save hojendiz/605bc31e303295f32dbea6432996eaf4 to your computer and use it in GitHub Desktop.
Save hojendiz/605bc31e303295f32dbea6432996eaf4 to your computer and use it in GitHub Desktop.
Download ZIP
Stop email spoofing by having two email address at the From header. Spamassassin Rule
Raw
local.cf
# Some malwares are implementing a technique to spoof email that consist in having two email address in the "From" header:
# From: Amazon Legit Account <confirm@amazon.com> <reception.lvh@hackedemail-domain.com>
# Usually the email clients only show the first email
# This is a local spamassassin rule to prevent this kind of email spoofing.
describe LOCAL_TWO_FROM_EMAILS The From has two emails, probably email spoofing
header LOCAL_TWO_FROM_EMAILS From =~ /<.*\@.*>\s+<.*\@.*>/i
score LOCAL_TWO_FROM_EMAILS 9.0 # Set this value at your discretion
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment