[Users] Warning message based on a header?

[Frédéric Nass]

Thank you Barry & Fred. I will study what you sent me when I find the time to do so. 

The idea behind this... 

Currently, we maintain post-treatment anti-phishing rules based on keywords combined with URLs from certain domains that we have identified as regularly hosting phishing forms. 
When these rules match, we add weight to messages (score) which usually leads to them being marked as SPAM. But sometimes the URL pointed in the phishing email is not in our list and the message escapes tagging. 

The idea would be to position a header on the message when one or more rules match based keywords combinations only (whatever the URL in the message) so that the user, at least, gets alerted that the message may be malicious. 

Regards, 
Frédéric. 

----- Le 5 Juil 23, à 9:55, Frederic Maussion <frederic at maussion.org> a écrit : 

> Maybe the Zimlet [ https://github.com/Zimbra/zimbra-zimlet-xspam | XSpam ] could
> be a good start to tweak it.

> Best,

> Fred

> From: "Frédéric Nass" <frederic.nass at univ-lorraine.fr>
> To: "users" <users at lists.zetalliance.org>
> Sent: Wednesday, July 5, 2023 8:21:09 AM
> Subject: [Users] Warning message based on a header?

> Hello folks,

> Are you aware of any Zimbra setting or Zimlet that would add a red warning on
> the email read panel saying "This message could be malicious" based on the
> presence of a specific header in the message?

> Regards,
> Frédéric

> --
> Frédéric Nass

> Sous-direction Infrastructures et Services
> Direction du Numérique
> Université de Lorraine
> Tél : +33 3 72 74 11 35
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.zetalliance.org/pipermail/users_lists.zetalliance.org/attachments/20230706/cfd8edbe/attachment.html>