From jeffc@surbl.org Fri Jun  4 17:37:37 2004
From: Jeff Chan <jeffc@surbl.org>
To: discuss@lists.surbl.org
Subject: [SURBL-Discuss] large number of empty URIs preceeding actual one
Date: Fri, 04 Jun 2004 08:37:23 -0700
Message-ID: <4210090417.20040604083723@supranet.net>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============4196482458569612722=="

--===============4196482458569612722==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

Not sure if this is a new type of spam or not:

  http://www.surbl.org/fitch7826drug.us.4jun04.txt

This example I just received had many real or joe job URIs
with no text in the anchor like:

  <a href=3D"http://www.elysian-MUNGED.com"></a>

Perhaps it's trying to run out some counters, but the real
target domain is visible as the last "removal" URI:

  <a href=3D"http://=
  www.ozone.fitch7826drug-MUNGED.us/d.ddd">here.</a>

> Name:    fitch7826drug.us
> Address:  61.250.93.214

Where this IP is in sbl.spamhaus.org of course.

The "ordering" link just before it was broken (no dot, at
least in my MUA, The Bat!):

  <a href=3D"http://fitch7826drug=
  us/b94">Click

Interestingly SpamCop did parse the message correctly in terms
of ignoring the blank anchors and finding only the clickable
ones.

That said, if urirhsbl or SpamCopURI limit the number of
URIs checked, these could sneak through.  A useful behavior
might be to ignore any non-clickable anchors, if we're not
already doing that.

Jeff C.
-- 
Jeff Chan
mailto:jeffc(a)surbl.org
http://www.surbl.org/

--===============4196482458569612722==--