Re: Google url redirect ?

Il giorno gio 26 dic 2024 alle ore 16:56 Matus UHLAR - fantomas <
[email protected]> ha scritto:

> I might have received similar similar spam shortly after your message:


> X-Spam-Status: No, score=1.8 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
>          DKIM_VALID_AU,DKIM_VALID_EF,DMARC_MISSING,HREF_EMPTY_XANTIABUSE,
>          HREF_EMPTY_XAUTHED,HTML_MESSAGE,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,
>          SPF_PASS,T_REMOTE_IMAGE,URI_GOOGLE_PROXY autolearn=disabled
>          version=4.0.0
>
> meta           URI_GOOGLE_PROXY       __URI_GOOGLE_PROXY &&
> !__FSL_RELAY_GOOGLE && !__TO___LOWER && !__MSGID_OK_HEX && !__HAS_CAMPAIGNID
> uri            __URI_GOOGLE_PROXY
>  m;^https?://[^.]+\.googleusercontent\.com/proxy/;
>
> and source contains this:
>
> <img st=
> yle=3D"margin:0;padding:0;box-sizing:border-box;vertical-align:middle" alt=
> =3D"" src=3D"
> https://ci3.googleusercontent.com/proxy/X8Q_KWklntUHsnaepTZ3W9=
>
> 9TIpNz0Ne6IlWhxGdnZrBwsgTPQFav-jBNaatr-M-drsxy1xeucxFn8q528XK6Ya1slCHSJXW-H=
>
> QDwZovedAYkr6Dg4VIyS2OIa9GsNnBJHgtGecqDwzrcXQ=3Ds0-d-e1-ft#https://www.mvmn=
> <https://ci3.googleusercontent.com/proxy/X8Q_KWklntUHsnaepTZ3W9=9TIpNz0Ne6IlWhxGdnZrBwsgTPQFav-jBNaatr-M-drsxy1xeucxFn8q528XK6Ya1slCHSJXW-H=QDwZovedAYkr6Dg4VIyS2OIa9GsNnBJHgtGecqDwzrcXQ=3Ds0-d-e1-ft#https://www.mvmn=>
> ext.hu/foldgaz/contents/Ugyfelszolgalat/Ertesito/view-the-bill-icon.png"
>

That's quite obvious. The pattern is correct catched by the
URI_GOOGLE_PROXY


> >I'm preparing the zip file woth some  the
> >Do you want me to send the zip file ( I have 46 mails that have failed ) ?
>
> Not me, but perhaps check your source as well?
>

My ( malformed ) question was directed to jhardin, as he asked for that.


> >> Feel free ot zip up spamples and send them to me directly for review, if
> >> we're missing new variants or some Google domains that would help us
> >> improve our coverage.
>
That's the relevant part :)

Pierluigi