# Quarantine Watch  guide for AKE and Narin

advmfr.net email protection · effective 2026-08-14 · last updated 2026-08-17
Contact for alerts: Bastien (bastien@elevaseo.com)

## What changed

Suspicious emails (very high spam score, or executable/macro attachments) no longer reach
user inboxes. They are parked in a central **Quarantine** folder. Nothing is deleted
automatically during the observation phase  your job is to watch that folder and tell us
when something looks wrong, so we can tune the rules. The old filters that bounced an
error back to spammers are gone (they were damaging the server's reputation).

## Where everything lives

**cPanel**: `https://arome.o2switch.net:2083`, account `sc6mixq8738` (AKE holds the
credentials).

**The Quarantine folder** (central, one for the whole company):
cPanel → Email Accounts → filter "System Account" → row `sc6mixq8738` → **Check Email**
→ Roundcube → folder **Quarantine**.
Everything caught by the global filters lands here, whatever the original recipient was.
It started catching traffic on 2026-08-17.

**The filters**: cPanel → Email section → **Global Email Filters**. They run top to
bottom on every incoming email for all 87 mailboxes. Current list:

| # | Filter | Catches | Action |
|---|---|---|---|
| 1 | `Executables & scripts` | attachments named .exe .js .vbs .ps1 .iso etc. | move to Quarantine |
| 2 | `EXEC` | macro documents (.docm .xlsm .pptm etc.) | move to Quarantine |
| 3 | `10-quarantine-score10` | spam score 10 or more | move to Quarantine, becomes silent deletion after 7 clean days (earliest 21 Aug 2026) |

Coming next, once the critical-senders list arrives: `00-whitelist-critical` in
position 1 (protected senders skip all other rules).

**Track Delivery** (the delivery log): cPanel → Email → **Track Delivery**.
Three things to know:
- data is kept **24 hours only**;
- the search box needs the **full email address** (a partial domain finds nothing);
- "Accepted" means handed to the outbound relay, not necessarily delivered. If the
  relay refuses afterwards, the error email (NDR) arrives in the sender's own inbox.

**Per-user Spam folders**: each mailbox also has its own Spam/Junk folder, filled by
the o2switch antispam. That layer is independent of our global filters and unchanged.

**Outbound limit** (why the HR mailing broke on 17 Aug): the whole domain shares
**180 outgoing emails per hour**. Above the limit, mail is first delayed, then
**destroyed**. So: no bulk mailing from any `@advmfr.net` mailbox, ever. Company-wide
mailings (HR, announcements) go through the Google side (`advmfr.com`), for example a
Google Group holding the staff's personal addresses.

**The DMARC report mailbox**: `dmarc@advmfr.net` (created for runbook step 6).
It only receives automatic XML reports from Google, Microsoft, etc. about who sends
mail claiming to be advmfr.net. Nobody reads it by hand: Bastien's local script digests
it weekly. Do not delete its content, do not reply to anything in it, and it never goes
on the whitelist.

**This documentation**: the `Advmfr/Spam` folder (Bastien's side), with `CHANGELOG.md`
recording every change with its date.

## Daily check: once a day, takes about 2 minutes
(every day until 21 Aug 2026; after that, twice a week. Pick a fixed moment,
for example right after lunch.)

1. Open the Quarantine folder (path above).
2. Scan the senders and subjects. Ask one question only:
   **is there any message here that a real person is waiting for?**
   - All spam/malware → nothing to do. Done for today.
   - One message looks legitimate (a real customer, supplier, colleague) → **do not
     delete or move anything**  send an alert (template below).

### What a false positive looks like

- A sender your company actually works with (check spelling carefully  spammers use
  look-alike domains such as `kasikornbank-secure.com` instead of `kasikornbank.com`).
- A subject that matches an ongoing business conversation (an order number, a real
  project name).
- When unsure → alert anyway. A false alarm costs 2 minutes; a lost customer email
  costs much more.

Note (verified 2026-08-17): the daily `tradefinance@kasikornbank.com` messages to
`chanhom@` are genuine KBank correspondence. If one ever shows up in Quarantine,
that is a false positive to report.

## Weekly check: once a week, takes about 5 minutes
(pick a fixed slot on a busy weekday, for example Monday 14:00, because the log
only covers the previous 24 hours)

1. Open Track Delivery (path above). Data covers the last 24 h only, so pick a busy
   weekday.
2. Click **Show Blocked & Failed**.
3. Report anything unusual:
   - a burst of similar messages (same sender pattern, same subject)  a new spam wave;
   - legitimate-looking senders in the failed list;
   - any result reading "FAIL with message" (should never appear again  alert immediately);
   - any line saying "exceeded the max emails per hour" or "Message discarded": real
     outgoing mail is being lost. Note which mailbox is sending and alert immediately;
   - any address like `something.advmfr@gmail.com` (a Gmail twin of a company mailbox)
     appearing as sender or recipient in business threads. Report it before anyone
     replies, and never act on payment details coming from such an address.

## FAQ

**"If an email goes into a user's Junk folder, can I just click Not Junk?"**
Yes. The Junk folder belongs to that user and is filled by the o2switch antispam;
clicking "Not Junk" (or dragging the message back to the Inbox) simply recovers the
message. It is safe, nothing is deleted. Three things to know:

1. It does **not** train the filter. The o2switch antispam does not learn from that
   click, so if the same sender keeps landing in Junk, report it with the alert
   template and we will add them to the protected senders list.
2. It only applies to a user's own Junk folder. The central **Quarantine** folder is
   a different thing: never move or release anything out of Quarantine yourself
   (see the do NOT list), report it instead.
3. Before clicking Not Junk on a message with an attachment or a payment request,
   run the false-positive checklist above (look-alike domains especially). When
   unsure, ask first.

## Alert template

Send to Bastien (email or chat), one message per incident:

    ALERT  advmfr.net quarantine
    Date/time seen: …
    Folder or screen: Quarantine / Track Delivery
    Sender: …
    Recipient: …
    Subject: …
    Why it looks legitimate (or suspicious): …
    Screenshot attached: yes/no

## Rules  do NOT

- ❌ Do not delete or empty the Quarantine folder during the observation phase
  (deletion policy starts later, and evidence is needed to tune the rules).
- ❌ Do not edit, delete, or reorder anything in **Global Email Filters**.
- ❌ Do not add whitelist entries yourself  send the request instead.
- ❌ Do not enable **BoxTrapper** on any mailbox (it sends automatic challenges that
  damage the server's reputation).
- ❌ Do not release a quarantined attachment to a user unless Bastien confirmed it is safe.
- ❌ Do not send bulk mailings from any `@advmfr.net` mailbox (180/h shared limit,
  and the relay blocks bulk content).

## Calendar

| Period | Task |
|---|---|
| Until 21 Aug 2026 | Daily 2-min Quarantine check |
| After 21 Aug (if 7 clean days) | Score-10 rule switches to silent deletion; checks drop to twice a week |
| Quarterly | Quarantine + Spam folders purge (with Bastien), rules review |

If users report a missing email at any time: check Quarantine first, then Track Delivery
(full sender or recipient address), then alert with the template above.