I set this up today and ran it. Not only did it catch this morning's bait, but 4 other messages that came in previously that I didn't bother reporting. 😂
My company uses KnowBe4 (huh?) for this, but just "X-PHISH-CRID" and "X-PHISHTEST" headers, so the rule already matches.
X-PHISHTEST: This is a phishing security test from KnowBe4 . . .
Ed
npub1k4…fcyay
2026-06-10 15:57:44 UTC
in reply to nevent1q…ydu3
Author Public Key
npub1k4xx27xw3gnqq0z2wqaccarlm7p92a38eg0ajnwvx6h8pf0yzx6ssfcyaySeen on
wss://relay.momostr.pinkPublished at
2026-06-10 15:57:44 UTCEvent JSON
{
"id": "9f48a206086c40a5194af9d8ebef78c7efdb3bf52b57742864332de38e269887",
"pubkey": "b54c6578ce8a26003c4a703b8c747fdf82557627ca1fd94dcc36ae70a5e411b5",
"created_at": 1781107064,
"kind": 1,
"tags": [
[
"p",
"86b397086a130510861dd58f255fadeee1c47815185fa3bb628a06b4d6af31ac"
],
[
"e",
"1d8cb51d598bc509b43f784e2c11c89910e91a22249175dbf8d4f96ec621ce65",
"",
"root",
"86b397086a130510861dd58f255fadeee1c47815185fa3bb628a06b4d6af31ac"
],
[
"proxy",
"https://mastodon.social/@EdCates/116726632552379197",
"web"
],
[
"proxy",
"https://mastodon.social/users/EdCates/statuses/116726632552379197",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://mastodon.social/users/EdCates/statuses/116726632552379197",
"pink.momostr"
],
[
"-"
]
],
"content": "I set this up today and ran it. Not only did it catch this morning's bait, but 4 other messages that came in previously that I didn't bother reporting. 😂 \n\nMy company uses KnowBe4 (huh?) for this, but just \"X-PHISH-CRID\" and \"X-PHISHTEST\" headers, so the rule already matches.\n\nX-PHISHTEST: This is a phishing security test from KnowBe4 . . .",
"sig": "b0136b110fee53e66c3d2330df6714b8070f1c1bdf5f7b440e08837bfffcec048d1491a5c233ec280edc75dd66b97261ae57bf97800cda7efb2b0805547b85e2"
}