You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Olivier Coutu <ol...@zerospam.ca> on 2019/01/04 15:09:16 UTC

Hiding text with "
We have started seeing some clickbait spam that hides the suspicious 
text behind /<img alt/ tags, e.g.

https://pastebin.com/SLMyFvmN

The text /Optima Tax Relief: Do You Still[...]/ is visible in the email 
in thunderbird since the image does not load, but spamassassin's body 
rule does not trigger

/body        T_OPTIMA  /Optima Tax Relief/i/

Using ctrl-f does not find that text either. Other than rawbody, are 
there other options?

Re: Hiding text with " Posted by Bill Cole <sa...@billmail.scconsult.com>.
On 4 Jan 2019, at 10:09, Olivier Coutu wrote:

> We have started seeing some clickbait spam that hides the suspicious 
> text behind /<img alt/ tags, e.g.
>
> https://pastebin.com/SLMyFvmN
>
> The text /Optima Tax Relief: Do You Still[...]/ is visible in the 
> email in thunderbird since the image does not load, but spamassassin's 
> body rule does not trigger
>
> /body        T_OPTIMA  /Optima Tax Relief/i/

Of course not, because it is not body text. It's the content of an HTML 
tag attribute.

> Using ctrl-f does not find that text either.

Client issue.

> Other than rawbody, are there other options?

To detect oddities in HTML tag attribute contents, only rawbody or full 
rules will work.