[pants2]

This "content violation on your X post" phishing email is so common, we get about a dozen of those a week, and had to change the filters many times to catch them (because it's not easy to just detect the letter X and they keep changing the wording).

We also ended up dropping our email security provider because they consistently missed these. We evaluated/trialed almost a dozen different providers and finally found one that did detect every X phishing email! (Check Point fyi, not affiliated)

It was actually embarrassing for most of those security companies because the signs of phishing are very obvious if you look.

[pixl97]

It easy to block all phishing email. Just block all email.

It's much much harder to block emails that aren't actually phishing but have components that would flag them anyway.