[Mimedefang] [OT] Re:Fw: Interesting Phishing Trick

[Kevin A. McGrail]

I put a rule in for testing just for this part of the process but a nested 
<a> tag inside another <a> tag is a good idea as well.  I want to see what 
the corpus view is on this issue as well.

rawbody         KAM_PHISH1      /u style="cursor: pointer"/
describe        KAM_PHISH1      Test for PHISH that changes the cursor
score           KAM_PHISH1      0.01


Regards,
KAM

> Is there an SA rule that checks for nested anchors? (Either in 3.1 or 
> SARE.) Any signs of this idiom in ham corpuses?