We have a spamfilter running that does a very good job at tackling common spammer issues.
From what it catches, I'm assuming it blocks mails based on a few things:
- SPF checks
- Certain attachment formats (
.exe, .swf, ...)
- Known spam servers (+ the companies 'private' spam lists)
- A combination of the above by applying a form of AI.
We have some false positives that we manually allow through, but we're fine with that rather than letting too much pass through.
Today, however, one got through:
A presumably hacked Gmail account sending a message that
They were stuck in Turkey, with no money and the embassy will fly them back if we can transfer them 2K for a ticket.
- There's no attachments as it's a social engineering attack.
- There are some keywords, like
Turkey, these will stop this wave of spammers, but the next just changes a few lines and they're through again.
- It's Gmail, which is relatively secure, but which is being exploited by attacking users through weak passwords, which we cannot detect on our side, and we can't globally block either.
Has anyone managed to interrupt this kind of Nigerian Prince Spam from reaching end users? Is it even possible to properly distinguish these mails from 'normal' mails?
As I'm Dutch, to me it's pretty easy to notice the Google-Translate English->Dutch that has been used. But of course, some end-users with financial-level access might not follow the same reasoning.