Hello,
I identified in a header of a phishing message a image name pattern. Below follow an example:
Content-Type: image/jpeg;
name="1560469802890.jpg"
Are 13 numbers of 0 the 9. Then, i created a custom rule to add a score for theses messages. Bellow has an example:
header JPEG_CT...