RE: I've got TORA.08 spelled with numbers?

2006-11-17 Thread Suhas Ingale \(QualiSpace\)
Even I have started getting it. 

Have any one cracked any rules for this?

Warm Regards,
Suhas
System Administrator
QualiSpace - A QuantumPages Enterprise
An ICANN Accredited Domain Registrar
===
Tel India: +91 (22) 6792 - 1480
Tel US: +1 (614) 827 - 1224
Fax India: +91 (22) 2530 - 3166
URL: http://www.qualispace.com 
===
For Any Technical Query Please Use: http://helpdesk.qualispace.com 
QualiSpace Community Discussion forum: http://forum.qualispace.com 
-Original Message-
From: Jeff Moss [mailto:[EMAIL PROTECTED] 
Sent: Friday, November 17, 2006 9:15 PM
To: users@spamassassin.apache.org
Subject: I've got TORA.08 spelled with numbers?

I'm getting a bunch of spams this morning that have
TORA.08 spelled out with numbers like this.

4216775   0611576   215556 7 3308011   3258576
   6  7 5   153 85 2   7 3
   8  3 6   50   4   1   2 7   0 5
   7  2 2   257873  5 7  4 1   3387715
   6  2 5   7  1   111500075 8 6   2 2
   8  2 2   7   7  3   2   656   0 3   0 8
   0  6430533   44 8   6   207   5412501   7637213


Does anybody know what this is about.

  Regards
  Jeff Moss





RE: I've got TORA.08 spelled with numbers?

2006-11-17 Thread Suhas Ingale \(QualiSpace\)
Lol

Warm Regards,
Suhas
System Administrator
QualiSpace - A QuantumPages Enterprise
An ICANN Accredited Domain Registrar
===
Tel India: +91 (22) 6792 - 1480
Tel US: +1 (614) 827 - 1224
Fax India: +91 (22) 2530 - 3166
URL: http://www.qualispace.com 
===
For Any Technical Query Please Use: http://helpdesk.qualispace.com 
QualiSpace Community Discussion forum: http://forum.qualispace.com 

-Original Message-
From: Giampaolo Tomassoni [mailto:[EMAIL PROTECTED] 
Sent: Friday, November 17, 2006 9:36 PM
To: users@spamassassin.apache.org
Subject: RE: I've got TORA.08 spelled with numbers?

 So, here is a question...  Why spam everyone with TORA.08, I 
 don't even know 
 what the heck that means!!!

I guess it is a (japanese?) nickname.

Maybe the nickname of the bot/worm/virus maker?

It is possible that this advertising is targeted to spammers, not to real
customers: it looks like Ehy, see? I can flood people's mailboxes with it!
Come and buy my services.

Ah, these business people...

giampaolo

 
 
 - Original Message - 
 From: Evan Platt [EMAIL PROTECTED]
 To: users@spamassassin.apache.org
 Sent: Friday, November 17, 2006 10:48 AM
 Subject: Re: I've got TORA.08 spelled with numbers?
 
 
  At 07:44 AM 11/17/2006, you wrote:
 I'm getting a bunch of spams this morning that have
 TORA.08 spelled out with numbers like this.
 
 4216775   0611576   215556 7 3308011   3258576
 6  7 5   153 85 2   7 3
 8  3 6   50   4   1   2 7   0 5
 7  2 2   257873  5 7  4 1   3387715
 6  2 5   7  1   111500075 8 6   2 2
 8  2 2   7   7  3   2   656   0 3   0 8
 0  6430533   44 8   6   207   5412501   7637213
 
 
 Does anybody know what this is about.
 
  Got 2 also.
 
  Wasn't there a stock image spam with TORA.TORA or something?
  
 






RE: I've got TORA.08 spelled with numbers?

2006-11-17 Thread Suhas Ingale \(QualiSpace\)
Is this safe to try?

Warm Regards,
Suhas
System Administrator
QualiSpace - A QuantumPages Enterprise
An ICANN Accredited Domain Registrar
===
Tel India: +91 (22) 6792 - 1480
Tel US: +1 (614) 827 - 1224
Fax India: +91 (22) 2530 - 3166
URL: http://www.qualispace.com 
===
For Any Technical Query Please Use: http://helpdesk.qualispace.com 
QualiSpace Community Discussion forum: http://forum.qualispace.com 

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
Sent: Friday, November 17, 2006 9:41 PM
To: Billy Huddleston
Cc: users@spamassassin.apache.org
Subject: Re: I've got TORA.08 spelled with numbers?


this seems to catch them:

header __MAILER_OL_6626 X-Mailer =~ /^Microsoft Outlook, Build 10\.0\.6626$/
header __MOLE_2962  X-MimeOLE =~ /^Produced\ By\ Microsoft\ MimeOLE\
V6\.00\.2900\.2962$/
meta JM_TORA_XM (__MAILER_OL_6626  __MOLE_2962)

--j.

Billy Huddleston writes:
 So, here is a question...  Why spam everyone with TORA.08, I don't even
know 
 what the heck that means!!!
 
 
 - Original Message - 
 From: Evan Platt [EMAIL PROTECTED]
 To: users@spamassassin.apache.org
 Sent: Friday, November 17, 2006 10:48 AM
 Subject: Re: I've got TORA.08 spelled with numbers?
 
 
  At 07:44 AM 11/17/2006, you wrote:
 I'm getting a bunch of spams this morning that have
 TORA.08 spelled out with numbers like this.
 
 4216775   0611576   215556 7 3308011   3258576
 6  7 5   153 85 2   7 3
 8  3 6   50   4   1   2 7   0 5
 7  2 2   257873  5 7  4 1   3387715
 6  2 5   7  1   111500075 8 6   2 2
 8  2 2   7   7  3   2   656   0 3   0 8
 0  6430533   44 8   6   207   5412501   7637213
 
 
 Does anybody know what this is about.
 
  Got 2 also.
 
  Wasn't there a stock image spam with TORA.TORA or something?