EXIM custom filter to block email address in name field?

[equens]

Hi all, do you know any rule to mark as spam the messages that have an email address in the name field?

From: "Name <[email protected]>" <[email protected]>

The email comes from [email protected] but shows [email protected] as the sender, so the recipient might think it is a trusted email.

Thanks!
Equens.

 

[keat63]

is it always the same sender, if so, then a global filter in cpanel should do this.

If Any Header Contains [email protected] then discard email

 

[equens]

Hello Keat63, thanks for your help. It's not the same sender, I would like to create rule across all servers to stop these emails.

 

[keat63]

Could you maybe post a snippet of the header so some of the experts can take a look.

 

[cPanelLauren]

Seeing the headers might be helpful indeed as suggested by @keat63

 

[equens]

Hello again:

Received: from unknown (HELO bork.domain.com) (119.252.18.x)
  by 0 with ESMTPS (DHE-RSA-AES256-GCM-SHA384 encrypted); 4 Oct 2019 09:19:01 -0000
Received: (qmail 49057 invoked by uid 89); 4 Oct 2019 09:19:01 -0000
Received: from unknown (HELO ?93.146.196.170?) (cmkadmin1@chad*****[email protected].***)
  by 0 with ESMTPA; 4 Oct 2019 09:18:58 -0000
Received: (qmail 19157 invoked by uid 89); 4 Oct 2019 09:18:59 -0000
Received: from mx7.web*****ot.com ([203.143.**.9]:54780)
by or***.dron***.net with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.92)
(envelope-from <[email protected]>)
id 1iGJkY-00005d-FN
for f****n@pre***.com; Fri, 04 Oct 2019 11:19:49 +0200
Received: fr*** n.dro***.net
by o***n.dro*****ia.net with LMTP
id sMRZCbUOl11mAQAAZqXNcQ
(envelope-from <[email protected]>)
for <fo****n@pr****ud.com>; Fri, 04 Oct 2019 11:19:49 +0200
Return-Path: <[email protected]>

From: "Pre*****ud <pre****ud@pre****.com>" <[email protected]>

To: =?utf-8?Q?Juan_A.-_Dpto.Formaci=C3=B3n_-_PREFOR?=
=?utf-8?Q?_SALUD?= <for*****@pr****ud.com>
Subject: [virus GenScript.GGG Troyano] propuesta
Date: Fri, 4 Oct 2019 12:18:55 +0200
MIME-Version: 1.0
Content-Type: multipart/mixed;

Best regards,
Equens.

 

[cPanelLauren]

Hello @equens

Do you utilize SpamAssassin on the domain/s receiving these types of emails? Has it flagged them if so? While a filter might be doable - I wonder if you wouldn't be able to get this resolved by going to WHM>>Server Configuration>>Exim Configuration Manager: Experimental: Rewrite From: header to match actual sender