Skip to main content
Muri
Muri
Explorer
May 8, 2024
Question

FortiMail - "Your password expires today" SCAM

  • May 8, 2024
  • 3 replies
  • 2814 views

Hello,

 

I will need an Idea how to manage or avoid of receiving e-mail messages like this?

Maybe with dictionary?

I tryed a bit with dictionary but it doesn't work as I expected, so I'm asking for help.

 

2024-05-08_14h22_32.png

3 replies

dbu
Staff
dbu
Staff
May 8, 2024

Hi Muri, 

May be you are looking to create a banned word options in the AntiSpam profile. 

Have a look at this article as it might help. 

Muri
MuriAuthor
Explorer
May 9, 2024

Yes, this is an option but not an optimal option, because some of those words can still appear in legite e-mail messages and then is not ok, to get such mail quarantined :)

Cajuntank
Cajuntank
Contributor III
May 8, 2024

Just adding to this from a "manage these emails" perspective as sometimes, they are just unavoidable... if those kinds of emails make it through the Access Control and IP Policy (I mentioned Geo blocking in another post you made) to the Recipient Policy and still don't get mitigated via the AntiSpam or AntiVirus, the email will likely show up in your end users mailbox. With URL Click protection configured/enabled via the Content profile, you will at least have had the URL rewritten and scanned via FortiGuard and maybe FortiSandbox (if licensed) to help protect your end users even if they do end up clicking on the URL (if it has not been removed by URL Click protection due to triggering certain categories you defined).

    AEK
    SuperUser
    AEK
    SuperUser
    May 8, 2024

    Hi Muri

    I think FortiGuard filter would have blocked such e-mail.

    Under FortiGuard section, enable IP Reputation, and enable primary URL filter and set it to the "default" URL profile.

    AEK
    Muri
    MuriAuthor
    Explorer
    May 9, 2024

    Hello,

    There was a problem, that the base URL was not malicious and after click on URL there was a redirect in behind which then opened a malicious site on the end.

    So therefore FortiGuard didn't recognize this URL as vulnerable.

    AEK
    SuperUser
    AEK
    SuperUser
    May 9, 2024

    In this case I agree with @Cajuntank , this can be protected by click protection feature.

    AEK
    Terms & ConditionsAccessibility statement