Re: More on phishing

2006-03-09 Thread Philip Prindeville
Philip Prindeville wrote: What about flagging HTML that has: a href=.* onMouseOver=window.status I.e. any links that attempt to intercept onMouseOver events and override the status window should be flagged as suspect... -Philip Actually, this seems to work: rawbody L_PHISH

Re: More on phishing

2006-03-09 Thread Kelson
Philip Prindeville wrote: Actually, this seems to work: rawbody L_PHISH /[aA] [hH][rR][eE][fF]=.* (onMouseOver|onMouseMouse)=window\.status=/ describe L_PHISHTest for PHISH overwrites the status bar score L_PHISH 6.0 I suppose I could beef it

Re: More on phishing

2006-03-09 Thread Philip Prindeville
Kelson wrote: Philip Prindeville wrote: Actually, this seems to work: rawbody L_PHISH /[aA] [hH][rR][eE][fF]=.* (onMouseOver|onMouseMouse)=window\.status=/ describe L_PHISHTest for PHISH overwrites the status bar score L_PHISH 6.0 I suppose I

Re: More on phishing

2006-03-09 Thread Loren Wilton
What about flagging HTML that has: a href=.* onMouseOver=window.status I.e. any links that attempt to intercept onMouseOver events and override the status window should be flagged as suspect... That would be nice, but spammers learned long ago (after I wrote rules for those things) that all

Re: More on phishing

2006-03-09 Thread Theo Van Dinter
On Thu, Mar 09, 2006 at 09:38:57PM -0800, Loren Wilton wrote: That would be nice, but spammers learned long ago (after I wrote rules for those things) that all you need to do is break the html over two lines and SA can't catch it, because rawbody can only work on one line at a time. Just to