Il giorno gio 26 dic 2024 alle ore 16:56 Matus UHLAR - fantomas < uh...@fantomas.sk> ha scritto:
> I might have received similar similar spam shortly after your message: > X-Spam-Status: No, score=1.8 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, > DKIM_VALID_AU,DKIM_VALID_EF,DMARC_MISSING,HREF_EMPTY_XANTIABUSE, > HREF_EMPTY_XAUTHED,HTML_MESSAGE,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE, > SPF_PASS,T_REMOTE_IMAGE,URI_GOOGLE_PROXY autolearn=disabled > version=4.0.0 > > meta URI_GOOGLE_PROXY __URI_GOOGLE_PROXY && > !__FSL_RELAY_GOOGLE && !__TO___LOWER && !__MSGID_OK_HEX && !__HAS_CAMPAIGNID > uri __URI_GOOGLE_PROXY > m;^https?://[^.]+\.googleusercontent\.com/proxy/; > > and source contains this: > > <img st= > yle=3D"margin:0;padding:0;box-sizing:border-box;vertical-align:middle" alt= > =3D"" src=3D" > https://ci3.googleusercontent.com/proxy/X8Q_KWklntUHsnaepTZ3W9= > > 9TIpNz0Ne6IlWhxGdnZrBwsgTPQFav-jBNaatr-M-drsxy1xeucxFn8q528XK6Ya1slCHSJXW-H= > > QDwZovedAYkr6Dg4VIyS2OIa9GsNnBJHgtGecqDwzrcXQ=3Ds0-d-e1-ft#https://www.mvmn= > <https://ci3.googleusercontent.com/proxy/X8Q_KWklntUHsnaepTZ3W9=9TIpNz0Ne6IlWhxGdnZrBwsgTPQFav-jBNaatr-M-drsxy1xeucxFn8q528XK6Ya1slCHSJXW-H=QDwZovedAYkr6Dg4VIyS2OIa9GsNnBJHgtGecqDwzrcXQ=3Ds0-d-e1-ft#https://www.mvmn=> > ext.hu/foldgaz/contents/Ugyfelszolgalat/Ertesito/view-the-bill-icon.png" > That's quite obvious. The pattern is correct catched by the URI_GOOGLE_PROXY > >I'm preparing the zip file woth some the > >Do you want me to send the zip file ( I have 46 mails that have failed ) ? > > Not me, but perhaps check your source as well? > My ( malformed ) question was directed to jhardin, as he asked for that. > >> Feel free ot zip up spamples and send them to me directly for review, if > >> we're missing new variants or some Google domains that would help us > >> improve our coverage. > That's the relevant part :) Pierluigi
