Phishing From Own Domain

From Roaring Penguin
Revision as of 14:37, 12 September 2017 by JohnMertz (talk | contribs) (Recommended Rule)

Jump to: navigation, search



Best Practices




Recommended Rule

The best solution for this is usually to create a Custom Rule (Compound Rule prior to version 10.1.0) that is triggered only when a sender spoofs the domain of the recipient.

  • Apply enough points to get trapped.

This rule will also trigger for some valid sources such as Mailchimp that are not spam, but will still pretend to be sending from your domain to limit confusion for recipients. You can will need to add an additional clause for each of these sources, if any, that apply to your domain. The clause follows the same format as the second clause above, but should instead use the name of the domain that you would like to make the exception for. If that domain were '' it would look like this:

AND (Domain of Envelope Sender is not

You can add as many exceptions as you like so long as you use that logic and replace '' with the actual sending domain.

General Rule





Display Name Only (Variant)

It is also possible for the spammer to spoof both the Envelope address and the Header address without using appropriate formatting. For instance:

  From: [mailto:]

A 'mailto' is optional and will be interpreted by some mail readers as a link and thus it will not actually appear but it will be used to reply if clicked. The spammer will usually then use the same address as the Envelope Sender their own. Using the 'mailto' structure above, CanIt is not able to determine the Header From address because it is expecting the format:

  From: Display Name <>

This means that the recommended rule would not be able to hit. Therefore a supplementary rule for:

  (Header Matches RegExp From:[^@]* AND (Domain of Envelope Sender is not

will help in this situation. Again, should be replaced with your own domain. The RegExp pattern will match if your domain is anywhere in the From Header line.

This rule will also catch:

  From: John Doe [mailto:]

where the envelope sender is not Again, the Header From for the recommended rule will not match a "mailto", so the recommended rule does not work in this case.

The final way that a message can be spoofed is the least likely to fool a user, but is also almost impossible to catch. This is the case where the display name is a person you know, but neither the Header address, nor the envelope address is their. Thus it is only spoofed in the sense that they have the same name (legitimate or not). The only way to target this would be to write a rule for every sender's name (including 'Last, First', 'F. Last', etc.) and reject if it doesn't come from the address you expect. This could cause lots of false-positives for common names or if a sender changes email addresses.

Spoofing From Other Domains

See Spoofed Addresses