Match for IP address links in body

[Vlad Mazek]

We've been seeing a ton of spam with links using http/https links to IP 
addresses instead of hostnames.

Has anyone else seen this pattern recently? If so, would you mind sharing a 
rule to match these links in the body of the message?

-Vlad

match emails starting with _

[Vlad Mazek]

How does one pattern match email addresses that start with _ or -

Looking through my logs, I can't find a single message sent by a _ or -
thats legit.

-Vlad

flooded with jr* spam

[Vlad Mazek]

Has anyone else noticed a similar pattern or does someone out there hate me?
:) The top 100 SPAM senders on my network (1 minute snapshot below) are all
forgeries starting with jr- or jq-

24  [EMAIL PROTECTED]
22  [EMAIL PROTECTED]
22  [EMAIL PROTECTED]
22  [EMAIL PROTECTED]
21  [EMAIL PROTECTED]
20  [EMAIL PROTECTED]
20  [EMAIL PROTECTED]
19  [EMAIL PROTECTED]
19  [EMAIL PROTECTED]
19  [EMAIL PROTECTED]
18  [EMAIL PROTECTED]
18  [EMAIL PROTECTED]
18  [EMAIL PROTECTED]
18  [EMAIL PROTECTED]
18  [EMAIL PROTECTED]
17  [EMAIL PROTECTED]
17  [EMAIL PROTECTED]
17  [EMAIL PROTECTED]
16  [EMAIL PROTECTED]
16  [EMAIL PROTECTED]
16  [EMAIL PROTECTED]
16  [EMAIL PROTECTED]
16  [EMAIL PROTECTED]
16  [EMAIL PROTECTED]
15  [EMAIL PROTECTED]
15  [EMAIL PROTECTED]
14  [EMAIL PROTECTED]
14  [EMAIL PROTECTED]
14  [EMAIL PROTECTED]
13  [EMAIL PROTECTED]
13  [EMAIL PROTECTED]
13  [EMAIL PROTECTED]
13  [EMAIL PROTECTED]
13  [EMAIL PROTECTED]
13  [EMAIL PROTECTED]
13  [EMAIL PROTECTED]
13  [EMAIL PROTECTED]
12  [EMAIL PROTECTED]
12  [EMAIL PROTECTED]
12  [EMAIL PROTECTED]
12  [EMAIL PROTECTED]
11  [EMAIL PROTECTED]
11  [EMAIL PROTECTED]
11  [EMAIL PROTECTED]
11  [EMAIL PROTECTED]
11  [EMAIL PROTECTED]
11  [EMAIL PROTECTED]
11  [EMAIL PROTECTED]
11  [EMAIL PROTECTED]
11  [EMAIL PROTECTED]
11  [EMAIL PROTECTED]
11  [EMAIL PROTECTED]
11  [EMAIL PROTECTED]
10  [EMAIL PROTECTED]
10  [EMAIL PROTECTED]
10  [EMAIL PROTECTED]
10  [EMAIL PROTECTED]
10  [EMAIL PROTECTED]
10  [EMAIL PROTECTED]
10  [EMAIL PROTECTED]
10  [EMAIL PROTECTED]
10  [EMAIL PROTECTED]
10  [EMAIL PROTECTED]
10  [EMAIL PROTECTED]
10  [EMAIL PROTECTED]
10  [EMAIL PROTECTED]
9   [EMAIL PROTECTED]
9   [EMAIL PROTECTED]
9   [EMAIL PROTECTED]
9   [EMAIL PROTECTED]
9   [EMAIL PROTECTED]
9   [EMAIL PROTECTED]
9   [EMAIL PROTECTED]
9   [EMAIL PROTECTED]
9   [EMAIL PROTECTED]
9   [EMAIL PROTECTED]
9   [EMAIL PROTECTED]
8   [EMAIL PROTECTED]
8   [EMAIL PROTECTED]
8   [EMAIL PROTECTED]
8   [EMAIL PROTECTED]
8   [EMAIL PROTECTED]
8   [EMAIL PROTECTED]
8   [EMAIL PROTECTED]
8   [EMAIL PROTECTED]
8   [EMAIL PROTECTED]
7   [EMAIL PROTECTED]
7   [EMAIL PROTECTED]
7   [EMAIL PROTECTED]
7   [EMAIL PROTECTED]
7   [EMAIL PROTECTED]
7   [EMAIL PROTECTED]
7   [EMAIL PROTECTED]
7   [EMAIL PROTECTED]
7   [EMAIL PROTECTED]

The annoying thing is, nothing particularly similar about the SPAM being
relayed...

-Vlad