Junk email suggestion

[dogsbody]

One characteristic of many junk emails is links to an undesirable site
disguised as links to another. Recent e-mails perporting to come from
MSNBC are in html format and contain items formatted as:

<a href="http://www.unwantedsite.com/">http://breakingnews.msnbc.com</a>

Perhaps the Outlook junk email filter (which I find generally very
effective) could be enhanced to spot these and junk them?

 

[Diane Poremsky [MVP]]

That would fall under phishing and it should detect them. What version of
outlook do you use and do you have all the latest updates installed?

--
Diane Poremsky [MVP - Outlook]



Outlook Tips by email:
(e-mail address removed)

EMO - a weekly newsletter about Outlook and Exchange:
(e-mail address removed)

You can access this newsgroup by visiting
http://www.microsoft.com/office/community/en-us/default.mspx or point your
newsreader to msnews.microsoft.com.

 

[dogsbody]

That would fall under phishing and it should detect them. What
version of outlook do you use and do you have all the latest updates
installed?

Thanks for the response.

It is Outlook 2007 (12.0.6316.5000) SP1 MSO (12.0.6213.1000). All up to
date. Yesterday's MS live update included an update to the junk email
filter (KB955433) and some have slipped past since that was installed.
There is no sign of an address in the message that remotely matches
anything in my (very short) safe senders list.

I did have the filter level set at "low" but I would have thought this
was such a clear sort of attack that it should be trapped. I seem to be
getting a few of these so I have now set the level to "high" to see if
it catches them. Maybe there is something in the messages to throw the
filter off track.

--

 

[Diane Poremsky [MVP]]

Low will catch very few - high misses a few (like the MSNBC spam that
replaces the CNN spam from last week) but overall, it gets most of mine.

--
Diane Poremsky [MVP - Outlook]



Outlook Tips by email:
(e-mail address removed)

EMO - a weekly newsletter about Outlook and Exchange:
(e-mail address removed)

You can access this newsgroup by visiting
http://www.microsoft.com/office/community/en-us/default.mspx or point your
newsreader to msnews.microsoft.com.

 

[dogsbody]

Low will catch very few - high misses a few (like the MSNBC spam that
replaces the CNN spam from last week) but overall, it gets most of
mine.

Yes it is the one that replaces the CNN spam. And high does miss it.
Low catches most of my spam - and I have never seen it put something
into the junk folder that would have upset me had I missed it and
deleted it.

There is a problem if you trap all items where the link destination
does not match the text because that would prevent legitmate text
messages (things like "More information".) However, I can't see any
legitimate reason for the text of a link to appear to be a web page
address and the destination to be a different web address. I think it
might be relatively easy to trap the situation.

--

 

[VanguardLH]

One characteristic of many junk emails is links to an undesirable site
disguised as links to another. Recent e-mails perporting to come from
MSNBC are in html format and contain items formatted as:

<a href="http://www.unwantedsite.com/">http://breakingnews.msnbc.com</a>

Perhaps the Outlook junk email filter (which I find generally very
effective) could be enhanced to spot these and junk them?

You need to know a little HTML in order to know of what you ask. The
address tag that you show is of the form:

<a href={URL}>{anystring}</a>

The URL is where you go when you click on the hyperlink. The string can
be anything. It does NOT need to be the same as the URL. Have you
never visited a site that had a "click here" link that you click on to
go to another web page? Obviously "click here" is not a URL. There is
no requirement that the string equal the URL. In fact, they rarely do,
especially as links in web pages. That they are different doesn't
itself qualify an e-mail as a phish mail.

Many users bitch but one of the reasons why IE7 forces the display of
the Address bar is to let the user see that where they though they were
going is indeed where they ended up.