I have had at least 5 of these come in today. The spamvertised site address seems to be generated by the following Javascript code. The code is the content of an *.html file attachment. The message bodies have been of two types. The variable names are different bayes poison in all the examples I have here. The arrays and for loop math are different.
forte = new Array ( lots of numbers spanning multiple lines ); meanly = new Array ( lots of numbers spanning multiple lines ); post = 284; incendiary = 205; var decrypt = ""; for(tariff = 0; tariff < post; tariff++) decrypt = decrypt + String.fromCharCode(forte[tariff] ^ meanly[ tariff % incendiary]); document.write(decrypt); An mbox file with these messages is at (Mozilla happily takes you to the spamvertised site if you try to grab the file in gzipped or uncompressed form.): http://www.lambertfam.org/~lambert/SpamAssassin/javascript_address_spam.zip This is the page mozilla took me to when the mbox was uncompressed or gzipped. That's why I zip'ed it instead. Sorry for the hassle. http://oceantricks.com/?affiliate_id=231902&campaign_id=401 Advertising Generic V. and Cal(whatever that word is) -- Scott Lambert KC5MLE Unix SysAdmin [EMAIL PROTECTED] ------------------------------------------------------- This SF.net email is sponsored by: Perforce Software. Perforce is the Fast Software Configuration Management System offering advanced branching capabilities and atomic changes on 50+ platforms. Free Eval! http://www.perforce.com/perforce/loadprog.html _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
