CastleCops, Internet Crime Fighters
Need help? Click here to register for free! Absolutely zero advertisements on this site!

Donation/Premium
spacer
block bottom
Security Central
spacer
· Home
· PIRT/Fried Phish
· MIRT
· SIRT
· Deutsch
· Wiki
· Newsletter
· O16/ActiveX
· CLSID List
· Contest2007
· Downloads
· Feedback (send)
· Forums
· HijackThis
· Hijacktrend
· LSPs
· My Downloads
· O18
· O20
· O21
· O22
· O23
· O9
· Premium
· Private Messages
· Proxomitron
· Reviews
· Search
· StartupList
· Stories Archive
· Submit News
· WsIRT
· Your Account
· Acceptable Use Policy
block bottom
spacer spacer

Filtering nasty URL References
Goto page Previous  1, 2
 
Post new topic   Reply to topic       All -> FavForums -> Product Suggestions [del.icio.us!] [digg it!] [reddit!]
View previous topic :: View next topic  
Author Message
IP: 68.51.*.*

Guest






PostPosted: Tue Dec 09, 2003 7:40 pm    Post subject:
Reply with quote

Ikeb wrote:

Doesn't an 'Origin blacklisted' take precedence to filters ... unless the filter is set to take precedence over the Friends list? Is the filter set to take precedence?


From my understanding the list in 'Spam Tools' is processed from Top Down so since 'My Filters' comes before 'Origin of Spam' a filter should catch something if it is to be caught by them, before the DNS spam blacklist servers have a whack at it.

Anyway since you say the filter should have caught it I'll keep an eye on it. I already know I have entered the filter rules correctly since it has hit on about three emails already.

Back to top
Ikeb

Special Response Team
Forums Admin

Joined: Apr 20, 2003
Posts: 16543

Forums Admin Moderators MVP Premium SRT Team CC Committee Team F@H

PostPosted: Tue Dec 09, 2003 8:18 pm    Post subject:
Reply with quote

Anonymous wrote:
Ikeb wrote:

Doesn't an 'Origin blacklisted' take precedence to filters ... unless the filter is set to take precedence over the Friends list? Is the filter set to take precedence?


From my understanding the list in 'Spam Tools' is processed from Top Down so since 'My Filters' comes before 'Origin of Spam' a filter should catch something if it is to be caught by them, before the DNS spam blacklist servers have a whack at it.

OK. I haven't used the DNS Blacklist servers so I can't confirm.

Anonymous wrote:
Anyway since you say the filter should have caught it I'll keep an eye on it. I already know I have entered the filter rules correctly since it has hit on about three emails already.

Now that I think about it some more .... not necessarily! Check my post in response to Cowboy. Note that the '@' sign should not be included. Yes you will get hits for any links that show your email address in the form 'AccountName@Server.Name' but the filter would miss links that show the two parts of your address separately.

Back to top
View users profile Send private message
Guest

Guest
IP: 68.51.*.*






PostPosted: Tue Dec 09, 2003 8:30 pm    Post subject:
Reply with quote

Ikeb wrote:

Note that the '@' sign should not be included.


Cool!! I'm using the filter from your first post. No '@' sign there.

Back to top
Ikeb

Special Response Team
Forums Admin

Joined: Apr 20, 2003
Posts: 16543

Forums Admin Moderators MVP Premium SRT Team CC Committee Team F@H

PostPosted: Tue Dec 09, 2003 10:02 pm    Post subject:
Reply with quote

Guest wrote:
Ikeb wrote:

Note that the '@' sign should not be included.


Cool!! I'm using the filter from your first post. No '@' sign there.

OK, that's great .... I think. Confused Are you the same guest that was having a problem earlier?

Back to top
View users profile Send private message
IP: 68.51.*.*

Guest






PostPosted: Tue Dec 09, 2003 11:37 pm    Post subject:
Reply with quote

Ikeb wrote:
Guest wrote:
Ikeb wrote:

Note that the '@' sign should not be included.


Cool!! I'm using the filter from your first post. No '@' sign there.

OK, that's great .... I think. Confused Are you the same guest that was having a problem earlier?


Wasn't a problem actually just an email that slipped past the filter for some reason but yea the only 'guest' that has been in this thread - so far - except for Cowboy.

As for the filter it was most likely a MW hiccup that let it past.

Back to top
cowboy

Guest
IP: 213.112.*.*






PostPosted: Thu Dec 11, 2003 6:46 pm    Post subject:
Reply with quote

I've been using the redirected link filter for a while now and think it's pretty good, but I have had one bad hit.
I checked with Testregexp what part of the mail triggered the filter.
This is the part that was marked by Testregexp:

Code:
<a href="http://rd.yahoo.com/SIG=12ctm40lg/M=267637.4116732.5333197.1261774/D=egroupweb/S=1705032277:
HM/EXP=1071201604/A=1853619/R=0/*http://www.netflix.com/Default?mqso=60178356&partid=4116732" alt="">

I suppose this is just a plain redirected link and there's really nothing to do about it.
The mail is from a mailing list which tags the mails like this and I found the same redirected link in other messages.

Back to top
Ikeb

Special Response Team
Forums Admin

Joined: Apr 20, 2003
Posts: 16543

Forums Admin Moderators MVP Premium SRT Team CC Committee Team F@H

PostPosted: Thu Dec 11, 2003 8:26 pm    Post subject:
Reply with quote

Interesting! I found www.netflix.com to be a site selling CDs. So the mailing list just copies links from other emails perhaps? Ask yourself who is www.netflix.com to you and why should they be redirecting from behind a yahoo.com link? Perhaps you might want to contact the mailing list and find out how they determine what/who to promote in the mailouts.

Back to top
View users profile Send private message
Cowboy

Guest
IP: 213.112.*.*






PostPosted: Thu Dec 11, 2003 11:21 pm    Post subject:
Reply with quote

It's a yahoo based mailing list.
So the odd thing is that the link which appears to go to netflix is really a link to yahoo which is redirected to netflix which is where you thought you were going in the first place.

Back to top
Ikeb

Special Response Team
Forums Admin

Joined: Apr 20, 2003
Posts: 16543

Forums Admin Moderators MVP Premium SRT Team CC Committee Team F@H

PostPosted: Fri Dec 12, 2003 3:29 am    Post subject:
Reply with quote

Cowboy wrote:
It's a yahoo based mailing list.

Ah OK. Mystery solved. So it's Yahoo slyly making it appear as if the link goes to their own site.

Cowboy wrote:
So the odd thing is that the link which appears to go to netflix is really a link to yahoo which is redirected to netflix which is where you thought you were going in the first place.

Actually the link should appear to be going to rd.yahoo.com/SIG=12ctm40lg/M=267637.4116732.5333197.1261774/D=egroupweb/S=1705032277:HM/EXP=1071201604/A=1853619/R=0/ when mousing over the link but really go to www.netflix.com/Default?mqso=60178356&partid=4116732 when the link is clicked. Is that not what happens?

Back to top
View users profile Send private message
Cowboy

Guest
IP: 213.112.*.*






PostPosted: Sat Dec 13, 2003 3:56 am    Post subject:
Reply with quote

That is what happens, but the animated picture that you click on says Netflix very clearly and doesn't say anything about Yahoo.

My best guess is it's some form of tracking system for Yahoo to know what is being clicked. Maybe it can't work like that, but I don't know any better.

In any case it's not a false ling in the sense that you don't get to where you thought you would get.

Back to top
Ikeb

Special Response Team
Forums Admin

Joined: Apr 20, 2003
Posts: 16543

Forums Admin Moderators MVP Premium SRT Team CC Committee Team F@H

PostPosted: Sat Dec 13, 2003 6:55 am    Post subject:
Reply with quote

Cowboy wrote:
That is what happens, but the animated picture that you click on says Netflix very clearly and doesn't say anything about Yahoo.

I see. So there a graphic involved? I didn't notice that in the HTML code you posted. So the graphic itself says Netflix, which has nothing to do with the mouseover action I was referring to of course, but it does indicate that there's nothing too underhanded going on here.

Cowboy wrote:
My best guess is it's some form of tracking system for Yahoo to know what is being clicked. Maybe it can't work like that, but I don't know any better.

I could be wrong but I don't think it works that way. Your browser determines where to go straight away; the redirection doesn't happen at the yahoo web site. The "obfuscation" occurs because the browser hides the redirection until after it takes place.

Cowboy wrote:
In any case it's not a false ling in the sense that you don't get to where you thought you would get.

The way I look at it it's just a company protecting it's "web presence" .... it's just a coincidence that company has called itself "Yahoo". Smile

Back to top
View users profile Send private message
Cowboy

Guest
IP: 213.112.*.*






PostPosted: Sat Dec 13, 2003 10:32 am    Post subject:
Reply with quote

I don't see how they can protect their web presense with redirected links. Question

Back to top
Ikeb

Special Response Team
Forums Admin

Joined: Apr 20, 2003
Posts: 16543

Forums Admin Moderators MVP Premium SRT Team CC Committee Team F@H

PostPosted: Sat Dec 13, 2003 7:55 pm    Post subject:
Reply with quote

Cowboy wrote:
I don't see how they can protect their web presense with redirected links. Question

Just by having the content being pointed to, appear to reside within the Yahoo web. Until you actually click on the link, there's nothing to indicate otherwise. While the graphic you referred to shows another company's logo, even it could easily reside within the Yahoo web.

Having said that, remember the SPAM you posted on Monday? It had a redirected gif link. Perhaps Yahoo uses graphic redirection to make it less obvious that even graphics are coming from outside their web? I would think any "benefit" would be marginal but perhaps Yahoo knows otherwise.

Back to top
View users profile Send private message
Display posts from previous:   
Post new topic   Reply to topic       All -> FavForums -> Product Suggestions All times are GMT
Goto page Previous  1, 2
Page 2 of 2

 
Quick Reply:
Username: 

Quote the last message
Attach signature (signatures can be changed in profile)
 
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © 2001 phpBB Group
spacer spacer