You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Alex <my...@gmail.com> on 2018/04/13 00:04:13 UTC
Google redirect with url shortener and undisclosed-recips
Hi,
We received an email to undisclosed-recipients that contained a google
redirect to an owl.ly site and another URL which appears to be a
direct download of a PDF.
https://pastebin.com/raw/DekDzifK
amavisd knew this single email was delivered to more than 40
recipients. Is there any way to benefit from that in spamassassin?
This seems to be a common denominator with a lot of these.
How much of a spam indicator is the google redirects? Can someone look
at this redirect as part of the redirector_pattern along with
__GOOG_REDIR? I also have a google redirect rule, and most mail it
hits is already spam or bulk mail of some sort.
Is T_DMARC_TESTS_FAIL or __DMARC_TESTS_FAIL reliable, and can we score
against that?
The links in the email are no longer a threat, but they're also not in
any URIBL because it's abuse of trusted services. The owl.ly link
somehow redirects to owl.li, a non-existent domain.
Re: Google redirect with url shortener and undisclosed-recips
Posted by John Hardin <jh...@impsec.org>.
On Thu, 12 Apr 2018, Alex wrote:
> We received an email to undisclosed-recipients that contained a google
> redirect to an owl.ly site
>
> https://pastebin.com/raw/DekDzifK
>
> amavisd knew this single email was delivered to more than 40
> recipients. Is there any way to benefit from that in spamassassin?
> This seems to be a common denominator with a lot of these.
How did it know that? Was it bcc'd to 40+ local users and there's some
side channel communicating that to Amavis? Or are you referring to 40+
separate deliveries of the same message, which would point at Razor et.
al. as the solution?
> How much of a spam indicator is the google redirects?
I'd say a google redirect to bit.ly or ow.ly is pretty suspicious,
potentially poison-pill suspicious...
> Can someone look at this redirect as part of the redirector_pattern
> along with __GOOG_REDIR?
I'll take a look and see about adding it to my sandbox.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Vista is at best mildly annoying and at worst makes you want to
rush to Redmond, Wash. and rip somebody's liver out. -- Forbes
-----------------------------------------------------------------------
Tomorrow: Thomas Jefferson's 275th Birthday
Re: Google redirect with url shortener and undisclosed-recips
Posted by John Hardin <jh...@impsec.org>.
On Thu, 12 Apr 2018, Alex wrote:
> We received an email to undisclosed-recipients that contained a google
> redirect to an owl.ly site and another URL which appears to be a
> direct download of a PDF.
>
> https://pastebin.com/raw/DekDzifK
I ran that through my testbed and it doesn't even see the google redirect
URI, perhaps because it's in data-saferedirecturl= rather than href= ...
Do we need to make the SA HTML parser aware of data-saferedirecturl= ?
That appears to be a gmail-ism that SA *should* probably be aware of, if
it can be used to hide spam signs.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Maxim IX: Never turn your back on an enemy.
-----------------------------------------------------------------------
Today: the 153rd anniversary of Lincoln's assassination