The image files tend to change just slightly less often than the domains. The image files appear to change once per campaign so far - but that's likely to change in the near future I think. The IP source is broadly distributed through the internet - these folks are using zombies.

HTH,
_M

At 09:29 AM 2/3/2004, you wrote:
ups,
 
just got one with .com/g9.gif  so i have to extend my filter. but i still think the gif is the pattern.
 

mfg
i.a.
gez. guhl

***********************************
lds nrw
dez. 235
tel.: 0211 9449 2578
fax.: 0211 9449 8344
mailto:[EMAIL PROTECTED]
***********************************

 

 
 
-----Ursprüngliche Nachricht-----
Von: Guhl, Markus (LDS)
Gesendet am: Dienstag, 3. Februar 2004 15:19
An: [EMAIL PROTECTED]
Betreff: AW: [Declude.JunkMail] Blocking the attached message

hi sharyn,

up to now i block this one with the following to filterlines

ANYWHERE 30 CONTAINS .com/v9.gif
ANYWHERE 30 CONTAINS .com/z7.gif

i found one of those gifs in all spams from this sender, the url itselfe changes, but the gifs are the same all the time.

mfg
i.a.
gez. guhl

***********************************
lds nrw
dez. 235
tel.: 0211 9449 2578
fax.: 0211 9449 8344
mailto:[EMAIL PROTECTED]
***********************************

 

-----Ursprüngliche Nachricht-----
Von: Sharyn Schmidt [mailto:[EMAIL PROTECTED]]
Gesendet am: Dienstag, 3. Februar 2004 15:01
An: 'Declude Junkmail List'
Betreff: [Declude.JunkMail] Blocking the attached message

Sorry, folks, to attach spam to an email but this is driving me NUTS.
 
No matter what I do, I can't seem to block this!
 
Is anyone else successfully blocking this one?
 
Thanks,
~Sharyn~
Network Administrator
Todhunter Information Systems
"Helping You Meet Our Customers' Needs Through Better Information"
-----Original Message-----
From: Margo Terry [mailto:[EMAIL PROTECTED]]
Sent: Sunday, February 01, 2004 5:33 PM
To: [EMAIL PROTECTED]
Subject: Re: Prescrip*tion Dr]ugs - Easy Ordering and Fast Delivery

Reply via email to