<html><body><div id="zimbraEditorContainer" style="font-family: Andale Mono; font-size: 12pt; color: #000000" class="52"><div>You can find a virtually identical repo to the zimlet that Barry links to here:<br><br><a href="https://github.com/btactic/spoofing-and-phishing-alert-zimlet">https://github.com/btactic/spoofing-and-phishing-alert-zimlet</a><br><br>and it even has its own release so that you can easily download the zimlet.<br><br>This has not been updated from November 2019 but it works quite well nowadays on ZCS 8.8.15 as far as I know.<br></div><div><br>> Currently, we maintain post-treatment anti-phishing rules based on keywords combined with URLs from certain domains that we have identified as regularly hosting phishing forms.<br>> When these rules match, we add weight to messages (score) which usually leads to them being marked as SPAM. But sometimes the URL pointed in the phishing email is not in our list and the message<br>> escapes tagging.<br>><br>> The idea would be to position a header on the message when one or more rules match based keywords combinations only (whatever the URL in the message)<br>> so that the user, at least, gets alerted that the message may be malicious.<br><br>My piece of advice is just to create a custom Spamassassin tag (not sure if that's the actual name) and then add add it the same way as FROMNAME_SPOOF was added: <a href="https://github.com/btactic/spoofing-and-phishing-alert-zimlet/commit/75947d755ec287e808b8fed822c920f4e086b946">https://github.com/btactic/spoofing-and-phishing-alert-zimlet/commit/75947d755ec287e808b8fed822c920f4e086b946</a> .<br><br>Yes, it means either forking the zimlet so that it has your custom Spamassassin tag or refactoring so that some of those X-Spam-Status values can be fetched from some zimlet config or something I guess.<br><br></div><hr id="zwchr" data-marker="__DIVIDER__"><div data-marker="__HEADERS__"><blockquote style="border-left:2px solid #1010FF;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><b>De: </b>"Frédéric Nass" <frederic.nass@univ-lorraine.fr><br><b>Para: </b>"users" <users@lists.zetalliance.org><br><b>Enviados: </b>Miércoles, 5 de Julio 2023 8:21:09<br><b>Asunto: </b>[Users] Warning message based on a header?<br></blockquote></div><div data-marker="__QUOTED_TEXT__"><blockquote style="border-left:2px solid #1010FF;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><br><div>Hello folks,<br></div><br><div>Are you aware of any Zimbra setting or Zimlet that would add a red warning on the email read panel saying "This message could be malicious" based on the presence of a specific header in the message?<br></div><br><div>Regards,<br></div><div>Frédéric<br></div><br><div>--<br>Frédéric Nass <br><br>Sous-direction Infrastructures et Services<br>Direction du Numérique <br>Université de Lorraine<br>Tél : +33 3 72 74 11 35</div></div><br></blockquote></div><div><br></div><div data-marker="__SIG_POST__">-- <br></div><div><div><span style="font-weight: bold; font-size: medium;"><a style="color: rgb(0, 0, 0);" href="http://www.btactic.com/" target="_blank"><span id="DWT100"><span style="font-family: verdana, helvetica, sans-serif;"><span class="Apple-style-span" style="background-color: rgb(255, 255, 255);"></span></span></span></a></span><span style="font-family: Arial; color: #5f5f5f; font-size: xx-small;"><span style="font-family: Arial; color: #5f5f5f; font-size: xx-small;"><span style="font-size: medium;"><span style="font-family: verdana,helvetica,sans-serif; color: rgb(0, 0, 0);"><span style="font-family: helvetica; font-size: small;"><strong>Adrián Gibanel</strong><br>I.T. Manager<br></span></span></span></span></span></div><div><br></div><div><span style="font-family: Arial; color: #5f5f5f; font-size: xx-small;"><span style="font-family: Arial; color: #5f5f5f; font-size: xx-small;"><span style="font-size: medium;"><span style="font-family: verdana,helvetica,sans-serif; color: rgb(0, 0, 0);"><span style="font-family: helvetica; font-size: small;">+34 675 683 301</span></span></span></span></span></div><div><span style="font-family: Arial; color: #5f5f5f; font-size: xx-small;"><span style="font-family: Arial; color: #5f5f5f; font-size: xx-small;"><span style="font-size: medium;"><span style="font-family: verdana,helvetica,sans-serif; color: rgb(0, 0, 0);"><span style="font-family: helvetica; font-size: small;">+34 973 270 382<br><a href="http://www.btactic.com" target="_blank">www.btactic.com</a><a href="http://btactic.com/" target="_blank"></a></span></span></span></span></span><br></div><div><span style="font-family: Arial; color: #5f5f5f; font-size: xx-small;"><span style="font-family: Arial; color: #5f5f5f; font-size: xx-small;"><span style="font-size: medium;"><span style="font-family: verdana,helvetica,sans-serif; color: rgb(0, 0, 0);"><span style="font-family: helvetica; font-size: small;"><br></span></span></span></span></span></div><div><div><div><div><div><span style="color: #008000; font-family: Arial; font-size: xx-small;"></span><span style="color: #008000; font-family: arial; font-size: xx-small;"><span class="Object" id="OBJ_PREFIX_DWT1467_com_zimbra_url"><span class="Object" id="OBJ_PREFIX_DWT1475_com_zimbra_url"><a target="_blank" href="http://www.btactic.com"><img style="border: 0px none;" src="https://www.btactic.com/wp-content/uploads/2018/10/logo-btactic.png" data-mce-src="https://www.btactic.com/wp-content/uploads/2018/10/logo-btactic.png" width="182" height="88"></a></span></span></span><b><b><span><span style="color: #5f5f5f; font-family: arial; font-size: xx-small;"><br></span></span></b></b><div><a href="https://www.facebook.com/btactic.befree" rel="nofollow noopener noreferrer nofollow noopener noreferrer nofollow noopener noreferrer nofollow noopener noreferrer nofollow noopener noreferrer nofollow noopener noreferrer" target="_blank" style="font-size: 12pt;"><img src="https://www.btactic.com/wp-content/uploads/2019/01/facebook.png" alt="”logo" data-mce-src="https://www.btactic.com/wp-content/uploads/2019/01/facebook.png" width="40" height="40"></a><a href="https://twitter.com/btactic" rel="nofollow noopener noreferrer nofollow noopener noreferrer nofollow noopener noreferrer nofollow noopener noreferrer nofollow noopener noreferrer nofollow noopener noreferrer" target="_blank" style="font-size: 12pt;"><img src="https://www.btactic.com/wp-content/uploads/2019/01/twitter.png" alt="”logo" data-mce-src="https://www.btactic.com/wp-content/uploads/2019/01/twitter.png" width="40" height="40"></a><a href="http://www.linkedin.com/company/btactic-sccl" rel="nofollow noopener noreferrer nofollow noopener noreferrer nofollow noopener noreferrer nofollow noopener noreferrer nofollow noopener noreferrer nofollow noopener noreferrer" target="_blank" style="font-size: 12pt;"><img src="https://www.btactic.com/wp-content/uploads/2019/01/linkedin.png" alt="”logo" data-mce-src="https://www.btactic.com/wp-content/uploads/2019/01/linkedin.png" width="40" height="40"></a><a href="https://www.instagram.com/btactic_befree/" rel="nofollow nofollow noopener noreferrer noreferrer" target="_blank" title="Instagram" style="font-size: 12pt;"><img src="https://www.btactic.com/wp-content/uploads/2022/11/instagram.png" data-mce-src="https://www.btactic.com/wp-content/uploads/2022/11/instagram.png" width="40" height="40"></a><a href="https://www.btactic.com/ya-somos-zimbra-sales-certified-partner/" rel="noopener nofollow noopener noreferrer nofollow noopener noreferrer nofollow noopener noreferrer nofollow noopener noreferrer" target="_blank" style="font-size: 12pt;"><img src="https://www.btactic.com/wp-content/uploads/2019/01/Zimbra_Individual_SalesCertified60.png" alt="”logo" data-mce-src="https://www.btactic.com/wp-content/uploads/2019/01/Zimbra_Individual_SalesCertified60.png" width="40" height="40"></a><a href="https://www.btactic.com/ya-estamos-registrados-en-el-catalogo-de-ciberseguridad-de-incibe/" rel="noopener nofollow noopener noreferrer" target="_blank" style="font-size: 12pt;"><img src="https://www.btactic.com/wp-content/uploads/2022/01/catalogo-sello.png" data-mce-src="https://www.btactic.com/wp-content/uploads/2022/01/catalogo-sello.png" width="39" height="39"></a><br></div><span style="color: #008000; font-family: arial; font-size: xx-small;"></span><span style="color: #008000; font-family: arial; font-size: xx-small;">Abans d´imprimir aquest missatge, pensa en el medi ambient. El medi ambient és cosa de tothom. / Antes de imprimir el mensaje piensa en el medio ambiente. El medio ambiente es cosa de todos. </span><span style="color: #5f5f5f; font-family: arial; font-size: xx-small;"><span style="color: #008000;">/ Before printing this message, think about the environment. The environment is something for everyone.</span> </span><br><span style="color: #5f5f5f; font-family: arial; font-size: xx-small;"></span><div><span style="color: #5f5f5f; font-family: arial; font-size: xx-small;"> AVIS: <br> El contingut d'aquest missatge i els seus annexos és confidencial. Si no en sou el destinatari, us fem saber que està prohibit utilitzar-lo, divulgar-lo i/o copiar-lo sense tenir l'autorització corresponent. Si heu rebut aquest missatge per error, us agrairem que ho feu saber immediatament <span class="Object" id="OBJ_PREFIX_DWT103">al remitent i que procediu a destruir el missatge</span>.<br> AVISO:<br> El contenido de este mensaje y de sus anexos es confidencial. Si no es el destinatario, les hacemos saber que está prohibido utilizarlo, divulgarlo y/o copiarlo sin tener la autorización correspondiente. Si han recibido este mensaje por error, les agradeceríamos que lo hagan saber inmediatamente <span class="Object" id="OBJ_PREFIX_DWT104">al remitente y que procedan a destruir el mensaje</span>.</span></div><div><span style="color: #5f5f5f; font-family: arial; font-size: xx-small;">WARNING: <br>The content of this message and its attachments is confidential. If you are not the intended recipient, you <span class="Object" id="OBJ_PREFIX_DWT1472_com_zimbra_date"><span class="Object" id="OBJ_PREFIX_DWT1480_com_zimbra_date">do</span></span> know that it is forbidden to use it, disclose it and / or copying it without authorization. If you have received this message in error, please send them to you <span class="Object" id="OBJ_PREFIX_DWT1473_com_zimbra_date"><span class="Object" id="OBJ_PREFIX_DWT1481_com_zimbra_date">do</span></span> know the sender immediately and proceed to destroy the message.</span></div><br></div><span style="font-family: Arial; color: #5f5f5f; font-size: xx-small;"><span style="font-size: medium;"><span style="font-family: verdana,helvetica,sans-serif; color: #000000;"></span></span></span></div><span></span></div></div></div></div></div></body></html>