filter on links in message body

5,417 views
Skip to first unread message

Michael Bierman

unread,
Jan 26, 2011, 12:54:26 PM1/26/11
to GMail Power Users
I'm suddenly getting a lot of spam in my inbox. I'm assuming that the
bad guys have found some loopholes in gmail's filtering... I have been
reporting them both as spam and phishing attacks. Nonetheless, they
are getting through on an hourly basis. So my next best option is to
filter them. The best thing seems to be to use the url, "http://
rus.ruschix.ru/" which is in every email as a link as follows

<a href="http://rus.ruschix.ru/" target="_blank">
<span style="font-size: medium; font-family: Verdana;"><strong>Visit
us to check it out!</strong></span></a>

can gmail filters be used on link refs or any other HTML for that
matter? Of course I could filter based on some of the visible text
such as

"International Marriage" but of course they are smarter than that and
use HTML to obfuscate strings (a trick that I thought gmail filters
were familiar with!) as in:

International <span style="color: rgb(51, 102, 204);"><strong>M</
strong></span><span style="color: rgb(0, 153, 0);"><strong>arriage</
strong></span>
<strong>agency</strong> is one of the modern ways

Any suggestions? i'm truly baffled why this stuff is suddenly getting
through Google's filters.

Andy

unread,
Jan 26, 2011, 3:11:38 PM1/26/11
to gmail-po...@googlegroups.com
> can gmail filters be used on link refs

I don't see why not.

In any event, it only takes 30 seconds to try it. Start creating a
filter, put the link in the Has The Words field, and press Test Search
to see if it finds the messages (when they are still in your Inbox).

I've found that a lot of times, the text I want to search for is in a
graphic file, so that text isn't even there in the email. That's
another technique they use to get around being detected.

> Any suggestions? i'm truly baffled why this stuff is suddenly getting
> through Google's filters.

Spam is a constant cat-and-mouse game, with the spammers occasionally
getting the upper hand for a while.

Andy

Zack (Doc)

unread,
Jan 26, 2011, 5:32:53 PM1/26/11
to gmail-po...@googlegroups.com
actually, the test search will find the e-mails, no matter where they are, unless they're in spam at the moment.

Another option, is on one of these e-mails, "Show Original"... then you can search on nearly anything displayed there.

I'd set the action to put them in some new label, and archive, so they don't make the inbox.  Then periodically, go to that label, select all, report spam, and then it's gone in 2 clicks.


--
You received this message because you are subscribed to the Google Groups "GMail Power Users" group.
To post to this group, send email to gmail-po...@googlegroups.com
To unsubscribe from this group, send email to gmail-power-us...@googlegroups.com
For more options, visit this group at http://groups.google.com/group/gmail-power-users?hl=en
To send a message to the owner, visit the following page:
http://groups.google.com/group/gmail-power-users/post?sendowner=1&hl=en

Michael Bierman

unread,
Jan 26, 2011, 7:19:04 PM1/26/11
to GMail Power Users
On Jan 26, 12:11 pm, Andy <AI.eg...@gmail.com> wrote:
> > can gmail filters be used on link refs
>
> I don't see why not.
>
> In any event, it only takes 30 seconds to try it.  Start creating a
> filter, put the link in the Has The Words field, and press Test Search
> to see if it finds the messages (when they are still in your Inbox).

yes, you are right it is quick to try. I guess I didn't make it clear
that I did try and no filter I could find actually catches HTML code.
maybe you know something I don't: can you demonstrate a filter that
would catch a link href? best I can tell you can only filter on
visible text not any of the markup. But I'd love to be wrong which was
what I was asking originally.

> I've found that a lot of times, the text I want to search for is in a
> graphic file, so that text isn't even there in the email.  That's
> another technique they use to get around being detected.

yes, one of many spammers use but that's a different topic. :)

> > Any suggestions? i'm truly baffled why this stuff is suddenly getting
> > through Google's filters.
>
> Spam is a constant cat-and-mouse game, with the spammers occasionally
> getting the upper hand for a while.

yes, but these are not new techniques. They go back to near the
beginning of HTML email and I haven't seen them work in Gmail before
that was why I was surprised.

Michael Bierman

unread,
Jan 26, 2011, 7:25:14 PM1/26/11
to GMail Power Users


On Jan 26, 2:32 pm, "Zack (Doc)" <z...@tnan.net> wrote:
> actually, the test search will find the e-mails, no matter where they are,
> unless they're in spam at the moment.

Where the message is is not an issue here. I'm trying to find out if
one can filter on HTML code in the email and it seems the answer is
no...at least not without a magic filter query.

> Another option, is on one of these e-mails, "Show Original"... then you can
> search on nearly anything displayed there.

I think not. Only the plaintext--not any HTML markup.

> I'd set the action to put them in some new label, and archive, so they don't
> make the inbox.  Then periodically, go to that label, select all, report
> spam, and then it's gone in 2 clicks.
>

Zack (Doc)

unread,
Jan 26, 2011, 7:34:10 PM1/26/11
to gmail-po...@googlegroups.com
>> Another option, is on one of these e-mails, "Show Original"... then you can
>> search on nearly anything displayed there.

>I think not. Only the plaintext--not any HTML markup.

OK... so I stepped a little far with "nearly anything", but you went too far the other way.  You can definitely filter on "some" things found in the header.  In particular, I've seen filters on "list-id" and "delivered", which are header only.

Did you try just "ruschix"?  I can't imagine that falling into normal conversation (except this thread), and it MIGHT find it like that.  My point of "where it is" is dependent on the quick-filter.  The test search will NOT work on the messages you've already put into Spam.

Michael Bierman

unread,
Jan 26, 2011, 7:38:03 PM1/26/11
to GMail Power Users
You are right there are some nify filters for headers but that's not
going to help here.

Again--the whole purpose of the question was to ask if one can write a
filter for markup. And no, ruschix does not appear in the email text--
only in the links in the email as you can see from the sample code I
posted above and so far as I can tell, Gmail doesn't allow filtering
of markup which is unfortunate.

Again, i would love to be wrong--if someone knows of a secret way of
telling gmail to filter on the email's markup that would be very cool
to know.

On Jan 26, 4:34 pm, "Zack (Doc)" <z...@tnan.net> wrote:
> >> Another option, is on one of these e-mails, "Show Original"... then you
> can
> >> search on nearly anything displayed there.
> >I think not. Only the plaintext--not any HTML markup.
>
> OK... so I stepped a little far with "nearly anything", but you went too far
> the other way.  You can definitely filter on "some" things found in the
> header.  In particular, I've seen filters on "list-id" and "delivered",
> which are header only.
>
> Did you try just "ruschix"?  I can't imagine that falling into normal
> conversation (except this thread), and it MIGHT find it like that.  My point
> of "where it is" is dependent on the quick-filter.  The test search will NOT
> work on the messages you've already put into Spam.
>

Patrick Liétar

unread,
Jan 27, 2011, 12:36:50 PM1/27/11
to gmail-po...@googlegroups.com
You can't filter on "Delivered-To:", can you? (except the topmost one because it matches another way, I think)
Reply all
Reply to author
Forward
0 new messages