You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Daniel Lemke <le...@jam-software.com> on 2010/06/15 11:08:41 UTC
mail with faked hyperlink
The following mail passed SA this morning:
http://pastebin.com/AgzqppqA
It contains several links that do not match their real target url so it's apparently trying to fool its reader.
Are there any rules or plugins that are able to catch mails like these?
Daniel
________________________________
----------------------------------------------------
JAM Software GmbH
Gesch?ftsf?hrer: Joachim Marder
Max-Planck-Str. 22 * 54296 Trier * Germany
Tel: 0651-145 653 -0 * Fax: 0651-145 653 -29
Handelsregister Nr. HRB 4920 (AG Wittlich) http://www.jam-software.de
Re: mail with faked hyperlink
Posted by Michelle Konzack <li...@tamay-dogan.net>.
Hello Daniel Lemke,
Am 2010-06-15 04:02:11, hacktest Du folgendes herunter:
> Hm got 1.8 from URIBL_BLACK and 1.8 from MISSING_MIMEOLE.
> But as stated, there should be a rule identifying the mismatch between shown
> url and real url target.
This would even hit legal newsletter from e.g. "Analog Devices" or such.
The problem is, that there are many enterprises which use Third-Party
Bulk-Mailer for there newsletters and in the same time the do analysis
useing the "faked" links.
If I would uses such rule, I would not more get messages from more then
20 enterprises...
I offer such Bulk-Mailservice, but I use a VHost of the customers domain
to avoid problmes with spamfilters...
Thanks, Greetings and nice Day/Evening
Michelle Konzack
--
##################### Debian GNU/Linux Consultant ######################
Development of Intranet and Embedded Systems with Debian GNU/Linux
itsystems@tdnet France EURL itsystems@tdnet UG (limited liability)
Owner Michelle Konzack Owner Michelle Konzack
Apt. 917 (homeoffice)
50, rue de Soultz Kinzigstraße 17
67100 Strasbourg/France 77694 Kehl/Germany
Tel: +33-6-61925193 mobil Tel: +49-177-9351947 mobil
Tel: +33-9-52705884 fix
<http://www.itsystems.tamay-dogan.net/> <http://www.flexray4linux.org/>
<http://www.debian.tamay-dogan.net/> <http://www.can4linux.org/>
Jabber linux4michelle@jabber.ccc.de
ICQ #328449886
Linux-User #280138 with the Linux Counter, http://counter.li.org/
Re: mail with faked hyperlink
Posted by Ned Slider <ne...@unixmail.co.uk>.
On 15/06/10 12:02, Daniel Lemke wrote:
>
>
> Michelle Konzack-2 wrote:
>>
>> On my standard Debian installation I get 6.8 Points...
>>
> Hm got 1.8 from URIBL_BLACK and 1.8 from MISSING_MIMEOLE.
> But as stated, there should be a rule identifying the mismatch between shown
> url and real url target.
>
...which would probably hit just as much ham as spam - it's not uncommon
for urls not to match the displayed test.
Re: mail with faked hyperlink
Posted by Daniel Lemke <le...@jam-software.com>.
Michelle Konzack-2 wrote:
>
> On my standard Debian installation I get 6.8 Points...
>
Hm got 1.8 from URIBL_BLACK and 1.8 from MISSING_MIMEOLE.
But as stated, there should be a rule identifying the mismatch between shown
url and real url target.
> Note: I do not use <hostkarma> because it has never worked for me.
>
I did some rescoring, having a close look on it for the next couple of days.
Daniel
--
View this message in context: http://old.nabble.com/mail-with-faked-hyperlink-tp28888901p28889905.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: mail with faked hyperlink
Posted by Michelle Konzack <li...@tamay-dogan.net>.
Hello Daniel Lemke,
Am 2010-06-15 09:08:41, hacktest Du folgendes herunter:
> The following mail passed SA this morning:
>
> http://pastebin.com/AgzqppqA
>
> It contains several links that do not match their real target url so
> it's apparently trying to fool its reader.
> Are there any rules or plugins that are able to catch mails like these?
On my standard Debian installation I get 6.8 Points...
Note: I do not use <hostkarma> because it has never worked for me.
Thanks, Greetings and nice Day/Evening
Michelle Konzack
--
##################### Debian GNU/Linux Consultant ######################
Development of Intranet and Embedded Systems with Debian GNU/Linux
itsystems@tdnet France EURL itsystems@tdnet UG (limited liability)
Owner Michelle Konzack Owner Michelle Konzack
Apt. 917 (homeoffice)
50, rue de Soultz Kinzigstraße 17
67100 Strasbourg/France 77694 Kehl/Germany
Tel: +33-6-61925193 mobil Tel: +49-177-9351947 mobil
Tel: +33-9-52705884 fix
<http://www.itsystems.tamay-dogan.net/> <http://www.flexray4linux.org/>
<http://www.debian.tamay-dogan.net/> <http://www.can4linux.org/>
Jabber linux4michelle@jabber.ccc.de
ICQ #328449886
Linux-User #280138 with the Linux Counter, http://counter.li.org/