You are viewing a plain text version of this content. The canonical link for it is here.

Posted to users@spamassassin.apache.org by Justin Mason <jm...@jmason.org> on 2004/02/20 20:50:26 UTC

Re: [Dshield] Incredible spam obfuscation (from MIMEDefang maillist)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


John Hardin writes:
>On Fri, 2004-02-20 at 06:26, Chris Santerre wrote:
>> > > 	
>> > http://lists.roaringpenguin.com/pipermail/mimedefang/2004-Febr
>> > uary/020188.html
>> > > 	
>> > http://lists.roaringpenguin.com/pipermail/mimedefang/2004-Febr
>> > uary/020203.html
>> > 
>> > Any rules to catch this trick?
>
>> I saw this as a direct attempt to foil Bigevil and similar URL marking
>> rules. Like Bayes poison (fodder) they are trying to mess up automated
>> scripts from harvesting the correct URLs to blacklist. But I do these by
>> hand, so I only pull out the legit URLs from these spam. 
>> 
>> So Short answers is I've not seen a rule for this. But I do have the legit
>> URLs in my Bigevil for the ones I do get. 

BTW, could someone try something --

see if a mail with e.g. "via<a href=someURL>gra" matches the body
pattern correctly.   I'm guessing it will, but it's worth a test.
If it doesn't, open a bug at bugzilla...

- --j.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)
Comment: Exmh CVS

iD8DBQFANmUCQTcbUG5Y7woRAh2vAJ9eeP9HXXlJu+RjJ0TNKXNX4xYTRQCeIzDH
nVcj/uT+HvQuDpGVBLmY6RE=
=59E4
-----END PGP SIGNATURE-----