On Wed, June 19, 2013 3:14 pm, Axb wrote:
> iirc, MailScanner munges the URL befor SA sees it so unless your plugin
> idea involves a crystal ball, it's not possible.
Yes, MailScanner gets to it before SA does, unless SA is called from
within MailScanner (which it isn't, on my setup, but that is a possible
setup). However, the complete original URL is still contained within the
munged one. It's in the alt attribute of the img tag, as you can see in
the examples I posted. Therefore, a crystal ball is hardly necessary...
just a regexp. I think that's pretty possible, don't you?
> btw - all these spams have a very obvious trait.
> Look at the source thoroughly.
Are you referring to the <font size=0%> tag, or the X-nnn header? Or
neither one?
Either way, by "all" do you mean the two I just posted? That's hardly
"all." There are many examples of style-gibberish spam that do not share
either of the above traits.
Thanks.
--- Amir
