Yes I do but when the phishing is in italian I know (and use) one updated sources of patterns but sometimes it is late...
Just as an example, a little bit of one body rule I wrote: clicca qui per (verificare|confermare|favore|riconvalidare|aggiornare) (la tua e-mail|il tuo account) in english it sounds like click here to (verify|confirm|reconfirm|update) (your email|your account) The rule has a score of 5.7 (5.6 is spam) but sometimes, when no rbl is fired and it is a never seen before wording unknown to bayes, DKIM/DMARC negative score don't flag the message. _______________________________________________ mailop mailing list mailop@mailop.org https://list.mailop.org/listinfo/mailop
