<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p style="margin-top:0;margin-bottom:0">If you have Thunderbird setup, then click the "More" button, then "View Source" then copy that text, redacted the local part of the recipient, then paste it into pastebin.com.</p>
<br>
<div style="color: rgb(0, 0, 0);">
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Eoin Kim <Eoin.Kim@rcst.com.au><br>
<b>Sent:</b> Monday, January 29, 2018 5:07 PM<br>
<b>To:</b> MailScanner Discussion<br>
<b>Cc:</b> David Jones<br>
<b>Subject:</b> RE: Checking URL on picture</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">Thanks David,<br>
<br>
So just download the message file and edit the receiver email address? I'll try. Thanks.<br>
<br>
Eoin<br>
<br>
-----Original Message-----<br>
From: MailScanner [<a href="mailto:mailscanner-bounces+eoin.kim=rcst.com.au@lists.mailscanner.info">mailto:mailscanner-bounces+eoin.kim=rcst.com.au@lists.mailscanner.info</a>] On Behalf Of David Jones via MailScanner<br>
Sent: Tuesday, 30 January 2018 8:52 AM<br>
To: mailscanner@lists.mailscanner.info<br>
Cc: David Jones <djones@ena.com><br>
Subject: Re: Checking URL on picture<br>
<br>
On 01/29/2018 04:39 PM, Eoin Kim wrote:<br>
> Hi Peter,<br>
> <br>
> Thanks for your help. But couldn't it be done in the phishing check on MailScanner instead of putting a SA rule? Thanks again.<br>
> <br>
> Eoin<br>
> <br>
<br>
I don't think you can't do a simple "uri" rule like that on content in <br>
an image. Please post the entire message via pastbin.com so we can see <br>
the full headers and body. You may/should redact the email address but <br>
don't change anything else. I would like to run it through my <br>
MailScanner and see how it scores.<br>
<br>
<br>
> -----Original Message-----<br>
> From: MailScanner [<a href="mailto:mailscanner-bounces+eoin.kim=rcst.com.au@lists.mailscanner.info">mailto:mailscanner-bounces+eoin.kim=rcst.com.au@lists.mailscanner.info</a>] On Behalf Of Peter Lemieux<br>
> Sent: Tuesday, 30 January 2018 8:35 AM<br>
> To: MailScanner discussion <mailscanner@lists.mailscanner.info><br>
> Subject: Re: Checking URL on picture<br>
> <br>
> On 01/29/2018 05:04 PM, Eoin Kim wrote:<br>
>> Is there any way to check hyperlink on a picture and block the message?<br>
>> I guess this is similar to phishing check? Thanks a lot.<br>
> <br>
> You can do it in SpamAssassin with the "uri" keyword:<br>
> <br>
> uri NO_GOOGLE /google\.com/i<br>
> score NO_GOOGLE 10<br>
> <br>
> With a score of ten, any message containing a URL that points to google.com<br>
> would likely be marked as a "high-scoring" spam and handled per your rules.<br>
> <br>
> Peter<br>
> <br>
> <br>
> <br>
> <br>
<br>
-- <br>
David Jones<br>
<br>
<br>
-- <br>
MailScanner mailing list<br>
mailscanner@lists.mailscanner.info<br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
</div>
</span></font></div>
</div>
</div>
</body>
</html>