Add brand impersonation detection for commonly abused names

[Copilot]

Detects brand names in email headers/subject (e.g., "costco", "paypal") and rejects messages when the sending domain doesn't match the legitimate domain. Addresses phishing attempts like From: "Costco Support" <spam@spammer.com> with subject containing "Costco".

Implementation

• Configuration: [commonly_abused] section maps brand names to legitimate domains, supporting variations (costco=costco.com, c0stc0=costco.com)

• Detection logic: New check_abused_names hook on data_post that:

  • Extracts domains from envelope MAIL FROM and header From using RFC-compliant regex (hyphens only mid-label)
  • Checks envelope from local part, header from display name, and subject against pre-compiled word-boundary patterns
  • Rejects via DENY when brand name found but neither envelope nor header domain matches legitimate OD

• Performance: Regex patterns pre-compiled during config load and cached in cfg.commonly_abused_patterns

• False positive prevention: Word boundary matching prevents "purchase" from triggering "chase", "tamazon.com" from triggering "amazon"

Example

[commonly_abused]
costco=costco.com
c0stc0=costco.com  # leetspeak variation
paypal=paypal.com

Rejects when costco appears in headers but domain is spammer.com. Allows when domain is costco.com or mail.costco.com.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.