URL Scanning in html attachments

[Paul Fowler <pf...@titanhq.com>]

Hi All,

I have a general question regarding URL scanning in attachments.
I have some spam that is getting through spamassassin dns blocklist filters which also have a known malicious URL embedded in a html attachment.
When I debugged the issue I found that the default rulesets and plugins do not seem to check the URL's in attachments.
So as far I am aware from reading very old posts and documentation and from debugging the issue I see that spamassassin does not scan URL's in a attachment.
Can someone confirm if I am I correct?
As some of the posts are nearly 10 years old is this just old information and no longer relevant?
Is there a current ruleset/plugin etc... that allows spamassassin to  scan URL's that are embedded within a html attachment?

Regards,
Paul

Re: URL Scanning in html attachments

[Riccardo Alfieri <ri...@spamteq.com>]

On 22/07/20 15:46, Paul Fowler wrote:

> Hi All,
>
> I have a general question regarding URL scanning in attachments.
>
I don't think SpamAssassin has a way to do that out of the box, but it's 
something that could be done inside a dedicated plugin. It would help 
also to get URLs from PDF attachments since some malware is using this 
approach (ie: Emotet in the past days)

-- 
Best regards,
Riccardo Alfieri

Spamhaus Technology
https://www.spamhaustech.com/