On 06/19/2013 11:30 PM, Amir 'CG' Caspi wrote:
Yes, MailScanner gets to it before SA does, unless SA is called from
within MailScanner (which it isn't, on my setup, but that is a possible
setup). However, the complete original URL is still contained within the
munged one. It's in the alt attribute of the img tag, as you can see in
the examples I posted. Therefore, a crystal ball is hardly necessary...
just a regexp. I think that's pretty possible, don't you?
SA's URIBL plugin doesn't and shouldn't look in the alt attribute.
As you have not given any details on how you glue SA if not with
MailScanner it's anybody's guess if its possible or not or even worth it.
btw - all these spams have a very obvious trait.
Look at the source thoroughly.
Are you referring to the <font size=0%> tag, or the X-nnn header? Or
neither one?
Either way, by "all" do you mean the two I just posted? That's hardly
"all." There are many examples of style-gibberish spam that do not share
either of the above traits.
the two samples you supplied do indeed include these but there may be
more. (God, I miss the SARE pattern hunting contests .-)
