cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
622
Views
0
Helpful
3
Replies

Restrict email with no text

MattBer810964
Level 1
Level 1

We have received numerous emails asking users to scan a QR code to get to a phishing page directing them to enter credentials. The email is nothing but a picture of a jpeg. Is there a way to restrict or block email that do not have text in them?

3 Replies 3

You'll want to test it, but a body search for
^\s*$ <= any number of whitespace characters
Or
^$ <= nothing

might work.

MattBer810964
Level 1
Level 1

Thank you for this information. We created a dictionary rule and added both of these expressions. We made a quarantine list for emails with these expressions. Every email we started to receive was getting put into these quarantines, whether they were blank or not. 

Dustin Anderson
VIP Alumni
VIP Alumni

We had similar about a month ago, image file, but they had a # and some numbers in the body, so we did a filter of attachment ends in jpg and body contained #[0-9][0-9][0-9] and that got most of them.