You are viewing a plain text version of this content. The canonical link for it is here.

Posted to users@spamassassin.apache.org by Chris Thielen <cm...@someone.dhs.org> on 2004/02/20 18:21:06 UTC

RE: [Dshield] Incredible spam obfuscation (from MIMEDefang maillist)

Steven Manross said:
> Isnt the answer really to catch the unclickable link...
>
> Namely,
>
> /<A HREF.*><\/A>/

FYI it would match thinggies like this:
<A HREF="bananas.html">Click here to see my new house pictures <img
src="houseicon.gif"></A>


--
Chris Thielen

Easily generate SpamAssassin rules to catch obfuscated spam phrases
(0BFU$C/\TED SPA/\/\ P|-|RA$ES):
http://www.sandgnat.com/cmos/

Re: [Dshield] Incredible spam obfuscation (from MIMEDefang maillist)

Posted by Chris Thielen <cm...@someone.dhs.org>.

sckot said:
>> Steven Manross said:
>> > Isnt the answer really to catch the unclickable link...
>> >
>> > Namely,
>> >
>> > /<A HREF.*><\/A>/
>> FYI it would match thinggies like this:
>> <A HREF="bananas.html">Click here to see my new house pictures <img
>> src="houseicon.gif"></A>


>    However, /<A HREF[^>]*><\/A>/i (or something more specific regarding
> what other characters were allowed) wouldn't.
>
> sckot Vokes

(replying back to list)
Yep, I think that would do the trick.


--
Chris Thielen

Easily generate SpamAssassin rules to catch obfuscated spam phrases
(0BFU$C/\TED SPA/\/\ P|-|RA$ES):
http://www.sandgnat.com/cmos/