I have a couple of filters that I'd like to share. I'll dedicate one to Cowboy 'cause he got on his high horse and unwittingly goaded me to action WRT words broken by HTML tags. The other goes to Denn988 for challenging me to learn this Regular Expression gobbledy gook.

Both filters look for URLs with SPAM fingerprints all over them. One checks for the recipient's email address buried in the URL, the other for redirected URLs - URLs that appear to the browser as going one place (e.g. ebay.com) and actually going to some sleazebag site (e.g. 202.108.255.203).

For the first one, just change the 'uname1|uname2|etc' part to whatever account names you use and 'domain_name' to your domain name.

In the second one, just get rid of the spaces between the two instances of the '&' and '#' characters (it seems neither disabling HTML nor using the [code] tags prevents conversion of an encoded character back to the character it represents) . Just to explain this filter a bit, the redirection is triggered by a '@' or '*' character (or the encoded equivalent) in the URL. Everything before such a character is ignored and the browser jumps to the hidden part behind that character. So that's what the filter looks for.

I've been using them for a week or so and haven't had a false positive. I was expecting the first one might trigger on some of my mailing lists and such but that hasn't happened to this point. BTW, I have found a strong correlation for hits on these filters and words broken by HTML tags.

Ikeb,

I just saw the above post and it looks rather interesting. I have added the two filters to my system for testing and evaluation.

As to special charactors used, you might find this link handy for many of the special charactors available.

Ikeb,

<hr width=35% align=left ><hr width=35% align=left ><hr width=35% align=left ><hr width=35% align=left >I thought you might like that link <hr width=35% align=left ><hr width=35% align=left ><hr width=35% align=left ><hr width=35% align=left >

<hr width=40% align=left ><hr width=30% align=left ><hr width=20% align=left ><hr width=10% align=left >Showoff! <hr width=10% align=left ><hr width=20% align=left ><hr width=30% align=left ><hr width=40% align=left >

Ikeb,

I have looked at the 'Redirected Link' filter and it shows promise. It us a very interesting strategy and would make a good addition to a filter set.

I have made a few changes to the filter to make it simpler and faster. Here is the code as modified:

Your regex is certainly simpler but I'm not sure that it would be any faster. I wanted to be sure that such a redirect is part of an '<a href>' tag, nothing else.

I note that you allow for '& #64' and '& #42' character encoding as well. I've never seen that but don't doubt this would represent the same thing as '& #064' and '& #042' respectively.

Ikeb,


To tell you the truth...I see no reason to limit the expression to an 'a href' tag. If you look at the following example tag, you may understand why.

It is doing the same thing, but it is using an image source (The above was taken from a post by Cowboy).


ALSO....

I was just testing the '@' (& #064) and '*' (& #042;) charactor representations using this forum and it will translate with as many as five leading zeros (7 numerals total...more than that and this forum returns a '?').

Try it for yourself...

Because of that, the code that I posted above would be better if it were changed to:

Code:

<[^>]*?http://[^>]*?(@|�*64;|\*|�*42;)http://[^>]*?> OR <[^>]*?http://[^>]*?(@|�{0,5}64;|\*|�{0,5}42;)http://[^>]*?>

You would want to make sure that your filter would still work no matter what the Spammer could legally come up with to zap it. Besides...you can post it without the spaces.

The main thing is that it looks like a good filter strategy....

You could have a point Denn988. (This is too weird -- it's like addressing R2D2 or some other robotic machine. "Yes Denn988, I have your coordinates." .... who the hell am I talking too??)

SPAMers could be making a "score" with the gif redirect but I thought they'd have to drag in at least something about the "mark".

In any event, I'll make a point of checking how much of my SPAM has such "graphicical redirection".

Ikeb,

I've put both of your filters from this thread into my filters list (at the top of the list) and I've gotten hits on both of them.

This morning I received an email that had the status of 'Origin blacklisted' so that email made it past all of my filters, but when I looked at the body of the email in the preview pane I could see my email address in one of the links. So for some reason it made it past your 'Email Account Buried in Link' filter.

I present the line from the preview pane for you to take a look at:

How wonderful! A filter dedicated to my lowly unregexwitted self. I'm going to treat the redirected link filter as mine because it works for me.

I don't quite understand the email filter.
Is the following a proper way to use it?