On Wed, Mar 08, 2006 at 04:25:40PM -0800, Kenneth Porter wrote: > >It's an interesting use, but I don't believe it would confuse > >SpamAssassin, etc. The second URI should be visible enough to be > >checked, and I added the IP to ph.surbl.org. > > Is there an SA rule that checks for nested anchors? (Either in 3.1 or > SARE.) Any signs of this idiom in ham corpuses?
Not in SA proper. For curiosity sake, I wrote up a quick rule to test
it out:
MSECS SPAM% HAM% S/O RANK SCORE NAME
0 27920 4940 0.850 0.00 0.00 (all messages)
1.400 1.0852 3.1781 0.255 0.00 1.00 TVD_NESTED_ANCHOR
ie: it's pretty horrible.
I also tried changing the rule to look for nested anchors where the
nested href goes https? to an IP:
0.009 0.0107 0.0000 1.000 1.00 1.00 TVD_NESTED_ANCHOR
but the 3 mails that got hit are nailed via other rules. Average score
of 11 for set0 in 3.2.0 (scores are defaults, no score generation
mass-check yet).
--
Randomly Generated Tagline:
"This is my sandbox, I'm not allowed to go in the deep end."
--Ralph Wiggum
This Little Wiggy (Episode 5F13)
pgpwgjrmGxUcm.pgp
Description: PGP signature
