Kevin A. McGrail skrev den 2017-09-27 16:52:
I recently stumbled onto a mail with a Spam link where the FROM
header field looked like this:
From: "Firstname Lastname@" <recipient-domain.com
sendern...@real-senders-domain.com>
Jakob, just wanted to let you know I identified this issue as well and
just opened a ticket about it yesterday to try and figure out a rule
against it. Can you send me spamples via pastebin, please?
untested:
header FROM_NAME_HAVE_SNABLE_A from:name /\@/i
who would test this ?
the above sample is doubble from domain in from:addr and from:name
both should be meta'ed
sorry if my syntax is not right, write it here on windows, so sorry
trying to help
