Re: [Declude.JunkMail] Cryptic URL in source

Thu, 10 Nov 2005 15:29:39 -0800

Harry,

If you have the Pro version, you can make use of the OBFUSCATION filter that I have posted at my site:

    http://www.mailpure.com/software/decludefilters/beta/

It will tag all such links where needless URL and/or HTML obfuscation is used.

Please note that I stopped maintaining these filters a while ago, mainly due to my own system becoming too customized for me to make generalized versions of these filters easily available, and also because I have focused more and more on writing external tests instead of Declude filters due to the flexibility that this environment offers me.  The OBFUSCATION filter though has changed little, and I do currently still use it.

Matt



Harry Vanderzand wrote: 
Yes that would work.

However I want a method that traps all mail that uses this deceptive
practice.

Is there no way to detect this trick?

Harry Vanderzand 
inTown Internet & Computer Services 
11 Belmont Ave. W., Kitchener, ON,N2M 1L2
519-741-1222

 

  
-----Original Message-----
From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED]] On Behalf Of Dave 
Beckstrom
Sent: Wednesday, November 09, 2005 5:28 PM
To: [email protected]
Subject: RE: [Declude.JunkMail] Cryptic URL in source

No problem.  


BODY   500 	contains google.com/url?q=




    
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- 
[EMAIL PROTECTED]] On Behalf Of Glenn \ WCNet
Sent: Wednesday, November 09, 2005 4:20 PM
To: [email protected]
Subject: Re: [Declude.JunkMail] Cryptic URL in source

I've been getting reports of that from customers all day.

G.Z.


----- Original Message -----
From: "Harry Vanderzand" <[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Wednesday, November 09, 2005 4:05 PM
Subject: RE: [Declude.JunkMail] Cryptic URL in source


Certainly

Here is what you see in the e-mail

http://intown.net/HwSbgXkc9vYP4qssBQS0AK6bumsUuatFHAdxX6IZ8vk0

Here is what is in the source:


      
href=""moz-txt-link-freetext" href="http://www.google.com/url?q=http://www.google.com/url?q=http://%">http://www.google.com/url?q=http://www.google.com/url?q=http://%
    
73%5
4%
41%09Nd%09%7aA.n%09e%74/%63%67i-
b%09%69n%09/%70%6fch/%72e%09di%72.%63g%69?s=

      
intown.net">http://intown.net/HwSbgXkc9vYP4qssBQS0AK6bumsUuatFHAdxX6IZ
    
8vk0
</
a>

Not that different from some of the phishing e-mails

This has got to be detectable and should be cause for 
      
immediate deletion.
    
Who has legitimate cause to hide their identity?

Harry Vanderzand
inTown Internet & Computer Services
11 Belmont Ave. W., Kitchener, ON,N2M 1L2
519-741-1222



      
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Scott 
Fisher
Sent: Wednesday, November 09, 2005 4:40 PM
To: [email protected]
Subject: Re: [Declude.JunkMail] Cryptic URL in source

Do you have an example?

----- Original Message -----
From: "Harry Vanderzand" <[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Wednesday, November 09, 2005 10:18 AM
Subject: RE: [Declude.JunkMail] Cryptic URL in source


        
Any ideas on this?
          
When the URL is hidden with cryptic characters in the 
            
source code 
    
of an e-mail it seems to me that it is obviously not a 
            
legitimate 
    
e-mail in that deception is being used.

Is there not an easy way to stop e-mail where these 
            
practises are 
    
being used?

I am running imail 8.21 and declude 3.05.18, the 
            
latest sniffer 
    
and Invuribl

Assistance is appreciated

Thank you

Harry Vanderzand
inTown Internet & Computer Services
11 Belmont Ave. W., Kitchener, ON,N2M 1L2
519-741-1222




---
This E-mail came from the Declude.JunkMail mailing list.  To 
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and 
type "unsubscribe Declude.JunkMail".  The archives can 
            
be found 
    
at http://www.mail-archive.com.


            
---
This E-mail came from the Declude.JunkMail mailing list.  To 
unsubscribe, just send an E-mail to 
          
[EMAIL PROTECTED], and type 
    
"unsubscribe Declude.JunkMail".  The archives can be found at 
http://www.mail-archive.com.

          
---
This E-mail came from the Declude.JunkMail mailing list.  To 
unsubscribe, just send an E-mail to [EMAIL PROTECTED], 
        
and type 
    
"unsubscribe Declude.JunkMail".  The archives can be found at 
http://www.mail-archive.com.


        
---
This E-mail came from the Declude.JunkMail mailing list.  To 
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
"unsubscribe Declude.JunkMail".  The archives can be found at 
http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To 
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
"unsubscribe Declude.JunkMail".  The archives can be found at 
http://www.mail-archive.com.
---
[This E-mail scanned for viruses by Declude Virus]
      
---
[This E-mail scanned for viruses by Declude Virus]


---
This E-mail came from the Declude.JunkMail mailing list.  To 
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and 
type "unsubscribe Declude.JunkMail".  The archives can be 
found at http://www.mail-archive.com.


    


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Reply via email to