You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Alton Danks <ad...@calvin.edu> on 2004/02/27 22:41:00 UTC
Rule to catch odd href tag
Hello,
I'm seeing some SPAM that has odd href tags like the following:
align="center"><a hrefShanghaishref=http://cowerers.com href=
"http://www.nungim.com/?ai=7030 ">
<img border="0" src=
"http://www.olivegrovetree.com/0/11/11-2.jpg" </a></p>
I'm not sure what the spammer gains by the odd href tag, but I would like to
create a rule to catch it when it is used.
I've tried:
rawbody CTS_HREF /\bhref[a-z]\b/i
rawbody CTS_HREF /\Whref[a-z]\W/i
and the same with body instead of rawbody -
with no results.
Ideally the rule would look for href followed by anything other than = or
space.
Al
Re: Rule to catch odd href tag
Posted by Loren Wilton <lw...@earthlink.net>.
Note this particular spam form is "<a href<letters>href=". Note the doubled
href.
There is a test in one of the rulesets that catches this guy specifically.
Loren
Re: Rule to catch odd href tag
Posted by David B Funk <db...@engineering.uiowa.edu>.
On Fri, 27 Feb 2004, Carl R. Friend wrote:
> On Fri, 27 Feb 2004, Alton Danks wrote:
>
> > I'm seeing some SPAM that has odd href tags like the following:
> >
> > align="center"><a hrefShanghaishref=http://cowerers.com href=
> >
> > "http://www.nungim.com/?ai=7030 ">
>
> [...]
>
> > I've tried:
> >
> > rawbody CTS_HREF /\bhref[a-z]\b/i
>
> Give /<a .{0,32}href[^=]/i a go. That's what I use here.
> The general idea is to scan for the <A anchor and look for an
> href that's followed by anything *other* than an equals sign
> within zero to 32 characters. That should bag your spammer.
I took the opposite tack with this particular specimen,
looking for a "href=http:" that is preceded by '\w' instead of
'\W'. (IE "href" should be a keyword.)
rawbody L_FAKE_HREF /\w\whref=http:/i
If you are worried about FPs, you could further qualify it
with: /<a .{0,32}\w\whref=http:/i
however because of the need for more backtracking, this will take
more CPU.
So far I haven't seen ay FPs here with the first form.
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
Re: Rule to catch odd href tag
Posted by Mat Bowen <M....@lboro.ac.uk>.
On Fri, 27 Feb 2004 21:14:21 -0500 (EST), Carl R. Friend wrote:
> On Fri, 27 Feb 2004, Alton Danks wrote:
>
>> I'm seeing some SPAM that has odd href tags like the following:
>>
>> align="center"><a hrefShanghaishref=http://cowerers.com href=
>>
>> "http://www.nungim.com/?ai=7030 ">
>
> [...]
>
>> I've tried:
>>
>> rawbody CTS_HREF /\bhref[a-z]\b/i
>
> Give /<a .{0,32}href[^=]/i a go. That's what I use here.
> The general idea is to scan for the <A anchor and look for an
> href that's followed by anything *other* than an equals sign
> within zero to 32 characters. That should bag your spammer.
>
Hi,
This gives several FP's here so maybe /<a .{0,32}href[^ =]/i would be
better?
Kind regards,
Mat
Re: Rule to catch odd href tag
Posted by "Carl R. Friend" <cr...@rcn.com>.
On Fri, 27 Feb 2004, Alton Danks wrote:
> I'm seeing some SPAM that has odd href tags like the following:
>
> align="center"><a hrefShanghaishref=http://cowerers.com href=
>
> "http://www.nungim.com/?ai=7030 ">
[...]
> I've tried:
>
> rawbody CTS_HREF /\bhref[a-z]\b/i
Give /<a .{0,32}href[^=]/i a go. That's what I use here.
The general idea is to scan for the <A anchor and look for an
href that's followed by anything *other* than an equals sign
within zero to 32 characters. That should bag your spammer.
+------------------------------------------------+---------------------+
| Carl Richard Friend (UNIX Sysadmin) | West Boylston |
| Minicomputer Collector / Enthusiast | Massachusetts, USA |
| mailto:crfriend@rcn.com +---------------------+
| http://users.rcn.com/crfriend/museum | ICBM: 42:22N 71:47W |
+------------------------------------------------+---------------------+
Re: Rule to catch odd href tag
Posted by Loren Wilton <lw...@earthlink.net>.
uri FAKE_HREF /a\s+href[\w]+href\b/
should do it.
Loren
Re: Rule to catch odd href tag
Posted by Mat Bowen <M....@lboro.ac.uk>.
On Fri, 27 Feb 2004 16:41:00 -0500, Alton Danks wrote:
> Hello,
>
> I'm seeing some SPAM that has odd href tags like the following:
>
> align="center"><a hrefShanghaishref=http://cowerers.com href=
>
> "http://www.nungim.com/?ai=7030 ">
> <img border="0" src=
>
> "http://www.olivegrovetree.com/0/11/11-2.jpg" </a></p>
>
> I'm not sure what the spammer gains by the odd href tag, but I
> would like to
> create a rule to catch it when it is used.
>
> I've tried:
>
> rawbody CTS_HREF /\bhref[a-z]\b/i
>
> rawbody CTS_HREF /\Whref[a-z]\W/i
>
> and the same with body instead of rawbody -
>
> with no results.
Hi,
I think the final \b and \W will cause it not to match since there is
more than one character after the href.
> Ideally the rule would look for href followed by anything other
> than = or
> space.
>
> Al
You could try:
rawbody CTS_HREF /\Whref[^ =]/i
I don't know if it may cause FP's, but it should do as you ask.
Kind regards,
Mat