gep2,
By way of noting the difficulty of getting filtering rules to be
correct:
They are not html tags at all. They are entirely valid URLs. And the
angle-brackets are the formal way to distinguish URLs in free-form text.
This highlights the difficulty of using correlation rules
that a) reflect only current activity, rather than anything inherent in
spam, and b) the need to be very, very careful about the details of the
rules.
gtc> Dave Crocker <mailto:dcrocker(_at_)brandenburg(_dot_)com>
gtc> Brandenburg InternetWorking <http://www.brandenburg.com>
gtc> Sunnyvale, CA USA <tel:+1.408.246.8253>, <fax:+1.866.358.5301>
gtc> One interesting thing I noted as I went through much of the "suspense"
E-mail
gtc> that had accumulated over the last few weeks (and based primarily on
content
gtc> filtering) is that numerous of my ASRG digests had been routed as "suspect
spam"
gtc> due to Dave's sig file (the mail filtering system content filter found his
gtc> telephone and fax numbers and decided that they looked like "bogus HTML
tags"...
gtc> which, of course, they are!).
d/
--
Dave Crocker <mailto:dcrocker(_at_)brandenburg(_dot_)com>
Brandenburg InternetWorking <http://www.brandenburg.com>
Sunnyvale, CA USA <tel:+1.408.246.8253>, <fax:+1.866.358.5301>
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg