diff options
| author | Danilo M. <danix@danix.xyz> | 2026-09-08 16:28:35 +0200 |
|---|---|---|
| committer | Danilo M. <danix@danix.xyz> | 2026-09-08 16:28:35 +0200 |
| commit | cc855e388dc2c1e02447578d05150c9cff63222f (patch) | |
| tree | 86c2f295606843864b7e886a39f010d89b6e3d73 /tests/fixtures/leaky.eml | |
| parent | 92dba06905ded925bc78e4bac74989363aad62d7 (diff) | |
| download | abusectl-cc855e388dc2c1e02447578d05150c9cff63222f.tar.gz abusectl-cc855e388dc2c1e02447578d05150c9cff63222f.zip | |
feat: report List-Unsubscribe urls and a differing Sender
A sweep of the user's real spam found List-Unsubscribe naming a domain
that appeared nowhere else in the message. It is attacker infrastructure
and was going unreported.
Every url from that header goes through redact.url() like a body url: an
unsubscribe link has to say who is unsubscribing, which makes it one of
the likeliest carriers of a recipient token. mailto: entries are skipped
rather than redacted, since the address is the whole value and nothing
useful survives removing it.
Sender is collected on the same terms as Reply-To, included only when it
differs from From. One repeating From is noise; one naming a separate
relay is the infrastructure behind the run.
Also drops the unused urlencode import left in redact.py when
_redact_kv_string stopped using urllib to rebuild the query string.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019NHaqA1Rz5ybed7wFUeQbK
Diffstat (limited to 'tests/fixtures/leaky.eml')
| -rw-r--r-- | tests/fixtures/leaky.eml | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/tests/fixtures/leaky.eml b/tests/fixtures/leaky.eml index f98d191..5ce3366 100644 --- a/tests/fixtures/leaky.eml +++ b/tests/fixtures/leaky.eml @@ -7,6 +7,8 @@ Received: from sender.example.invalid (unknown [203.0.113.42]) Return-Path: <bounce@sender.example.invalid> From: "Billing at you@example.org" <phish@sender.example.invalid> To: <you@example.org> +Sender: envelope@relay.example.invalid +List-Unsubscribe: <http://unsub.example.invalid/u?e=you@example.org>, <mailto:leave@unsub.example.invalid> Subject: Confirm now Message-ID: <eee555@sender.example.invalid> Date: Tue, 8 Sep 2026 16:00:00 +0200 |