2

A very persistent person(s) is continually spoofing a company employee's e-mail address with criminal intent. They attempt to e-mail other people in the company trying to trick them into believing the e-mail is coming from a co-worker. Each time they use a different "reply to" address. I've been trying to figure out a way to setup a filter in Gmail that trashes any spoofed e-mails that are not really authentic.

So the spoofed e-mails come from employee@OurDomain.com but the "reply to" field is alwayschanging@variousdomains.com. We can never stop them because they keep changing which e-mail they use in the "reply to". They even went as far as buying domain names very similar to ours so it would look real. They also tried calling so this goes beyond your average phishing. I contacted the registrar and had those cancelled as fraud but the e-mail spoofing continues.

My thought was setup a filter that is based on "has the words" but that only seems to apply to content the e-mail itself and not the header.

Is there a way to create a Gmail filter to filter e-mails based on the content in the e-mail header?

Or maybe I should take a different approach?

Gmail Advanced Search Reference:
https://support.google.com/mail/answer/7190?hl=en

Improve this question

2 Answers 2

Reset to default
3

You can use Google Script to search the Reply-To: field in the header and route messages to different folders if they do not match the domain in the From: field.

Here's a sample snippet for searching the Raw Header of a message via scripts.

function searchGmailByMessageHeader() {
  var threads = GmailApp.getInboxThreads();
  for (var t in threads) {
    var headers = threads[t][0].getRawContent().split("\r\n"));
    for (var h in headers) {
      if(headers[h].match(/Reply-to.*?DOMAIN_NAME/) {
      // DO SOMETHING
      break;
    }
  }
}

Also see: Advanced Gmail Filters with Apps Scripts

Improve this answer
2
  • Thank you very much Amit! If I understand this correctly would I need to have the spreadsheet with the activated filters running at all times for this to work? Or is this something that could run on its own without the spreadsheet being open? What if for example I am running a mail client such as Mac Mail would these rules still be applied via gmail?
    – chainwork
    Jul 25, 2015 at 21:50
  • It need not be tied to a spreadsheet. You can have the script running as a trigger and it will run itself every 'n' minutes.
    – Amit Agarwal
    Jul 27, 2015 at 18:22
0

After speaking with Google I found another solution using their "Content Compliance" settings. They describe as the following:

"The Content compliance setting enables you to specify what action to perform for messages based on predefined sets of words, phrases, text patterns, or numerical patterns. The Content compliance setting scans messages for content that matches one or more rules that you configure within the setting. You can choose whether these messages are rejected or delivered with modifications; for example, to notify others when the content of a message matches the rules that you set."

Using Content Compliance we were able to filter and flag by distinct patterns in the e-mail headers. Try it out.

More info here: https://support.google.com/a/answer/1346934?hl=en

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.