Embedded Hostile links

[Pramod Daya]

Hi,

I'm seeing embedded hostile links in HTML formatted emails - which are not getting picked up by spearphishing detection.  When I look at the email as plain text, they don't show up..   I tried creating a rule to identify the suspicious sites (usually bit.ly) and I can't seem to detect it with a spamassassin rule that search the body of the email.   Is spamassassin not able to view HTML formatted emails ?

Any advice would be welcome.

Thank you,
Pramod
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20210823/5ae5b529/attachment.html>