Phishing Protection

SpamFoo checks every email for phishing before running its spam and classification models. When it detects phishing, the result has a classification of phishing and the email is treated as spam.

How SpamFoo Detects Phishing

Three checks run on every message:

  • Known phishing links. Links in the message are checked against a list of known phishing sites. SpamFoo downloads this list automatically and refreshes it about once an hour. No account or extra setup is needed.
  • Identity impersonation. The sender's display name is compared against your protected identities. If a message claims to be from a protected person but comes from a domain you have not approved, it is flagged.
  • Domain lookalikes. The sender's domain is checked for typos and similar-looking characters that imitate well-known internet domains.

Phishing Reasons

When a message is classified as phishing, the API response includes a phishingReason field explaining why:

Reason Meaning
phishtank_match The message contains a link to a known phishing site
identity_impersonation The display name matches a protected identity, but the sender is not from an approved domain
identity_impersonation_lookalike Same as above, and the sender's domain is a typo or lookalike of an approved domain
domain_typosquat The sender's domain is a lookalike of a well-known internet domain

A phishing result looks like this: 

{
    "isSpam": true,
    "classification": "phishing",
    "phishingReason": ["identity_impersonation"],
    "bypassReason": "identity_impersonation",
    ...
}
Tip: Pass the recipient address with classification requests (the recipientEmail field, or the X-Recipient-Email header on stream requests). This tells SpamFoo which domain's protected identities to check. Without it, SpamFoo checks all protected identities, which still works but is less precise.

Protected Identities

A protected identity is a person or role that attackers are likely to impersonate, such as an executive, the payroll team, or IT support. Each identity pairs a display name with the domains that person legitimately sends from. For example: protect the name "Pat Jones" with the legitimate domain yourcompany.com. If a message arrives claiming to be from "Pat Jones" but the sender is pat.jones@freemail-example.com, SpamFoo flags it as phishing.

Protected identities also catch lookalike domains. A message from "Pat Jones" at yourc0mpany.com (a zero instead of an o) is flagged with the identity_impersonation_lookalike reason.

Managing Identities

Protected identities are managed per domain in the admin console on the Protected Identities page. There you can:

  • Add, edit, and delete identities
  • Enable or disable an identity without deleting it
  • Add a note to record why an identity exists
  • Import identities in bulk from vCard files (a .vcf file or a .zip of .vcf files)

Matching Modes

Each domain has a matching mode that controls how strictly legitimate senders are checked:

Mode Behavior
Relaxed (default) A sender is legitimate if their domain matches one of the identity's approved domains
Strict A sender is legitimate only if their full email address matches an approved address

Delegated Senders

Sometimes a legitimate outside sender triggers impersonation checks, for example an external assistant or a scheduling service sending on an executive's behalf. Add that sender's email address or domain as Delegated Sender on the Protected Identities page. Overrides apply to all protected identities for the domain.

Next Steps