Return-Path: 
 <users-return-69712-apmail-spamassassin-users-archive=spamassassin.apache.org@spamassassin.apache.org>
Delivered-To: apmail-spamassassin-users-archive@www.apache.org
Received: (qmail 18303 invoked from network); 8 May 2008 05:34:05 -0000
Received: from hermes.apache.org (HELO mail.apache.org) (140.211.11.2)
  by minotaur.apache.org with SMTP; 8 May 2008 05:34:05 -0000
Received: (qmail 40076 invoked by uid 500); 8 May 2008 05:33:55 -0000
Delivered-To: apmail-spamassassin-users-archive@spamassassin.apache.org
Received: (qmail 40049 invoked by uid 500); 8 May 2008 05:33:55 -0000
Mailing-List: contact users-help@spamassassin.apache.org; run by ezmlm
Precedence: bulk
list-help: <mailto:users-help@spamassassin.apache.org>
list-unsubscribe: <mailto:users-unsubscribe@spamassassin.apache.org>
List-Post: <mailto:users@spamassassin.apache.org>
List-Id: <users.spamassassin.apache.org>
Delivered-To: mailing list users@spamassassin.apache.org
Received: (qmail 40038 invoked by uid 99); 8 May 2008 05:33:55 -0000
Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136)
    by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 07 May 2008 22:33:55 -0700
X-ASF-Spam-Status: No, hits=8.2 required=10.0
	tests=SPF_PASS,URIBL_AB_SURBL,URIBL_BLACK,URIBL_OB_SURBL,URIBL_SC_SURBL
X-Spam-Check-By: apache.org
Received-SPF: pass (athena.apache.org: domain of me@junc.org designates
 80.166.75.17 as permitted sender)
Received: from [80.166.75.17] (HELO gate.junc.org) (80.166.75.17)
    by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 08 May 2008 05:33:07 +0000
Received: from localhost (localhost [127.0.0.1])
	by localhost.junc.org (Postfix) with ESMTP id A16AA16F4B0
	for <users@spamassassin.apache.org>; Thu,  8 May 2008 07:33:19 +0200 (CEST)
X-Virus-Scanned: amavisd-new at junc.org
Received: from localhost.junc.org ([127.0.0.1])
	by localhost (localhost.junc.org [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id dS8GoP6wRZNG for <users@spamassassin.apache.org>;
	Thu,  8 May 2008 07:33:18 +0200 (CEST)
Received: by home.junc.org (Postfix, from userid 81)
	id 9192416F4B2; Thu,  8 May 2008 07:33:18 +0200 (CEST)
X-Squirrel-UserHash: HhQ1AwccBkICEw4=
X-Squirrel-FromHash: RkEUX0YQVF4=
Message-ID: <47742.RkEUX0YQVF4=.1210224798.squirrel@gate.junc.org>
In-Reply-To: <893BF0FD1323EBB54BB2B402@[192.168.2.14]>
References: <45509.RkEUX0YQVF4=.1210103309.squirrel@gate.junc.org>
    <893BF0FD1323EBB54BB2B402@[192.168.2.14]>
Date: Thu, 8 May 2008 07:33:18 +0200 (CEST)
Subject: Re: IE Parse bug olso in SpamAssassin ?
From: "Benny Pedersen" <me@junc.org>
To: users@spamassassin.apache.org
User-Agent: SquirrelMail/1.4.9a
MIME-Version: 1.0
Content-Type: text/plain;charset=iso-8859-1
Content-Transfer-Encoding: 8bit
X-Priority: 3 (Normal)
Importance: Normal
X-Virus-Checked: Checked by ClamAV on apache.org


On Thu, May 8, 2008 05:00, Joseph Brennan wrote:
>> <p class=3DMsoNormal><a href=3D"http://{MACCCLINK=3Dtestmaclink,3,http://=
>> 67.228.184.50/links1.txt,www.easyaddedvivacecreation.com}/?asdfdwrt2qxfpm=
>> 7DuzjjB82iEozsAEajsqbE">Have a look at our site</a></p>
> Do you have a reference for more on this?  Is this just obfuscation or
> does it do something bad besides?

unsure what here, but when i have sent the mail here it was detected when i
get it back, but not in the initial email i get it from, so i might be

> Should we just call "http://{" bad, and not bother checking the uri?

i belive there is parts in sa that parse the same way as ie and that could be
used by spammers to hide there domains in multilvel obfu

one excample is redir.html with nearly allways redirect to medical selling host

how can one make the

redirector_pattern in local.cf to make it test redirect in redir.html ?

if sare team and sa code team se there corpus i am shure thay can se something
from it, i have tryed to make a redirector_pattern but no succes :/



Benny Pedersen
Need more webspace ? http://www.servage.net/?coupon=cust37098