Is this the format being referred to? These are consistently getting through SA for us too
http://pastebin.com/VHkfnTtm Jason On 01/04/12 10:05, John Hardin wrote: > On Sat, 31 Mar 2012, joea wrote: > >>>>> On 3/31/2012 at 8:22 AM, Michael Scheidell >>>>> <michael.scheid...@secnap.com> >> wrote: >> >>> if you need help, you need enough full information. >>> Or, you make the pastebin 'private', and send the link offlist to >>> someone who has volunteered to help. . . . . >>> >> >> If there are more volunteers, beyond the presumed one . . . feel free >> to . . . > > joea sent me the messages. It appears his bayes isn't running at all, > they got no BAYES_## hits whatsoever. > > The URLs in them also have a really suspicious form; I've added a > couple of rules for that to my sandbox. I suspect that the form is > really uncommon, though, perhaps just fat fingers by this one spammer, > so I doubt they will do well in masscheck. We'll see... > -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +1 408 481 8171 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
