Checking URL on picture

[David Jones]

If you have Thunderbird setup, then click the "More" button, then "View Source" then copy that text, redacted the local part of the recipient, then paste it into pastebin.com.

________________________________
From: Eoin Kim <Eoin.Kim at rcst.com.au>
Sent: Monday, January 29, 2018 5:07 PM
To: MailScanner Discussion
Cc: David Jones
Subject: RE: Checking URL on picture

Thanks David,

So just download the message file and edit the receiver email address? I'll try. Thanks.

Eoin

-----Original Message-----
From: MailScanner [mailto:mailscanner-bounces+eoin.kim=rcst.com.au at lists.mailscanner.info] On Behalf Of David Jones via MailScanner
Sent: Tuesday, 30 January 2018 8:52 AM
To: mailscanner at lists.mailscanner.info
Cc: David Jones <djones at ena.com>
Subject: Re: Checking URL on picture

On 01/29/2018 04:39 PM, Eoin Kim wrote:
> Hi Peter,
>
> Thanks for your help. But couldn't it be done in the phishing check on MailScanner instead of putting a SA rule? Thanks again.
>
> Eoin
>

I don't think you can't do a simple "uri" rule like that on content in
an image.  Please post the entire message via pastbin.com so we can see
the full headers and body.  You may/should redact the email address but
don't change anything else.  I would like to run it through my
MailScanner and see how it scores.


> -----Original Message-----
> From: MailScanner [mailto:mailscanner-bounces+eoin.kim=rcst.com.au at lists.mailscanner.info] On Behalf Of Peter Lemieux
> Sent: Tuesday, 30 January 2018 8:35 AM
> To: MailScanner discussion <mailscanner at lists.mailscanner.info>
> Subject: Re: Checking URL on picture
>
> On 01/29/2018 05:04 PM, Eoin Kim wrote:
>> Is there any way to check hyperlink on a picture and block the message?
>> I guess this is similar to phishing check? Thanks a lot.
>
> You can do it in SpamAssassin with the "uri" keyword:
>
> uri NO_GOOGLE     /google\.com/i
> score NO_GOOGLE   10
>
> With a score of ten, any message containing a URL that points to google.com
> would likely be marked as a "high-scoring" spam and handled per your rules.
>
> Peter
>
>
>
>

--
David Jones


--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20180130/b05ce5da/attachment.html>