[Declude.JunkMail] hacked Wordpress rule?

2012-06-08 Thread John Dobbin 
We are seeing a tremendous number of hacked Wordpress URL's in spam
messages.  What would be a good filter rule to catch

/wp-includes/

In the body source?



Thanks




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] hacked Wordpress rule?

2012-06-08 Thread David Barker 
BODY 10   PCRE  (?i:\/wp-includes\/)



From: John Dobbin [mailto:jo...@penpublishing.com]
Sent: Friday, June 08, 2012 1:34 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] hacked Wordpress rule?



We are seeing a tremendous number of hacked Wordpress URL’s in spam messages.  
What would be a good filter rule to catch

/wp-includes/

In the body source?



Thanks



--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type unsubscribe 
Declude.JunkMail. The archives can be found at http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type unsubscribe Declude.JunkMail.  The archives can be found
at http://www.mail-archive.com.