Hello,

I got reports for multiple spams in form:

From: "<redácted1 Martin, Ing.> martin.redact...@example.com"
        <sas...@taiheisya.com>
To: "ředácted xyz, Ing." <xyz.redact...@example.com>
Subject: Fw:  xyz.redact...@example.com

(I intentionally kept some chars with diacritics because that was similar to unredacted addresses looked like)

I was trying to catch these with FromNameSpoof plugin:

header  L_FROMNAME_EMAIL                eval:check_fromname_contains_email()
header  L_FROMNAME_DIFFERENT            eval:check_fromname_different()
header  L_FROMNAME_OWNERS_DIFFER        eval:check_fromname_owners_differ()
header  L_FROMNAME_DOMAIN_DIFFER        eval:check_fromname_domain_differ()
header  L_FROMNAME_SPOOF                eval:check_fromname_spoof()
header  L_FROMNAME_EQUALS_TO            eval:check_fromname_equals_to()
header  L_FROMNAME_EQUALS_REPLYTO       eval:check_fromname_equals_replyto()

neither of those nor any of _FNSFNAME*_ tags did hit
Am I expecting too much from FromNameSpoof?


--
Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
2B|!2B, that's a question!

Reply via email to