7 votes

Can anyone purchase a SSL certificate?If so what is it's significance in identifying phishing?

SSL Certificates are not designed to be used as a way to detect phishing. SSL Certificates are actually very cheap, even free. Let's Encrypt, offers completely free, completely automated certificate ...
user avatar
6 votes
Accepted

Why is fail2ban finding but not banning

Fail2ban appears to be rightfully not banning anyone - Your provided log does not show anyone exceeding the default limits that Ubuntu xenial ships with fail2ban. Look in your /etc/fail2ban/jail.conf,...
user avatar
  • 6,621
5 votes

SPF - Will softfail get inherited when included?

In short, include will normally just result in a match (if pass) or otherwise a non-match for negative results (or possibly an error in error conditions). The specific action, beyond pass / non-pass, ...
user avatar
4 votes
Accepted

Spamassasin regex body and header check not working

Your original rules: header __FRAUD_HEADER From =~ /.*@(?!example\.org)/i body __FRAUD_BODY /".*\@example\.org.*"(?!.*\@example\.org.*$)/i meta COMPANY_FRAUD (__FRAUD_HEADER && ...
user avatar
  • 869
4 votes
Accepted

Report phishing websites

You can report suspected phishing attempts to the Department of Homeland Security's US Computer Emergency Readiness Team (US-CERT) by forwarding the email in question to this address: phishing-report@...
user avatar
  • 239
3 votes
Accepted

How is this email passing DMARC?

I won't claim to be an expert on this, but the IETF pages for the X-Original-From header seem to imply this is expected behaviour when sending an email to a Google Apps mailing list. Google Apps ...
user avatar
  • 3,143
3 votes
Accepted

SPF and DMARC protection

Unfortunately, if the receiver does not submit dmarc reports, and does not validate SPF or DKIM, it may still receive the spam e-mail, which would result in that. There is no way to disallow a 3rd ...
user avatar
  • 738
2 votes
Accepted

Block people searching for server admin pages

There are some advantages to blocking such requests at the firewall level, namely: IPTABLES takes less resources to block the connection than Apache does to return an error. It will keep your log ...
user avatar
2 votes

Can anyone purchase a SSL certificate?If so what is it's significance in identifying phishing?

Yes, any website can be secured using SSL. Issuing certificate authority only validates if you own the domain. So phishing website can obtain certificate and be secured by SSL. SSL provides ...
user avatar
2 votes

Microsoft hosts domains that redirect to mine. Is there an innocuous explanation?

The "cas.ms" domain is used by Microsoft's Cloud App Security tool, in particular around the application conditional access control. Is it possible that someone has look to enable this service? This ...
user avatar
  • 38.1k
1 vote
Accepted

Is it common for nested subdomains to get blocked due to phishing detection?

Yes, while I agree that is its reckless to cause widespread problems with such overblocking, this is not limited to single entities that you could get to individually fix this for you. I installed ...
user avatar
  • 6,621
1 vote

Display full FROM email address in Outlook

I think you could try adding a custom form configuration file in the following guidance to your client so that there will be a column displaying the sender's email address in the message list: Show ...
user avatar
  • 1,323
1 vote

Email protected with SPF but received valid signature from other IP anyway

As defined in RFC 7208, 1.1.3, SPF is not tested against the RFC 5322 From header, but against the envelope sender i.e. the address in RFC 5321 MAIL FROM command. from=<www-data@rec15....
user avatar
1 vote

How to restore mail flow after Office 365 mailbox user was automatically restricted?

Glad to know this issue is resolved by yourself. You could mark it as answer. Or you also could use message tracking to check what process is blocking this message. How to Tell Which Transport Rule ...
user avatar
  • 769
1 vote

Can anyone purchase a SSL certificate?If so what is it's significance in identifying phishing?

Something to keep in mind is Extended Validation Certificates. An EV SSL certificate is issued to an organization after verifying an org owns the domain. These certificates were designed to prevent ...
user avatar
  • 1,175
1 vote

Report phishing websites

Got Phish? At the moment, the eminent SwiftOnSecurity maintains the following list of anti-phishing resources: http://gotphish.com This is an excellent and exhaustive resource for reporting ...
user avatar
  • 123
1 vote

Mailscanner: how to block html attachments only

This is a known issue with Mailscanner, it doesn't make distinction between inline and attachment entities. You may want to submit an issue: https://github.com/MailScanner/v5
user avatar
1 vote
Accepted

WP in docker container hacked - Server sends Phishing mails - disable container from other OS with the server volume mounted?

The manual solution would be to delete or move /var/lib/docker/containers. Inside of each sub-folder will be a config.v2.json and hostconfig.json which you may be able adjust by hand, particularly the ...
user avatar
  • 5,119
1 vote

Quick/safe way to mass delete SPAM messages from 100+ inboxes

Report messages that will be deleted using something like this. it will create a report in the target folder. If you remove -LogOnly it will copy the messages to the folder. This REALLY helps with ...
user avatar
  • 111

Only top scored, non community-wiki answers of a minimum length are eligible