Spotted this one in a message that only scored about 2.5. It was image-only spam with word salad below, and the link was...unorthodox, to say the least:

<A href="h
t
tp:/
/pfzxrwamqed.org&zunrs7d3ebsqfla9okv%2Egua
cofk
nhb%2Ecom/">

This is the first time I've noticed the protocol broken up by line breaks!

If I'm reading it correctly, guacofknhb<MUNGED>.com is the actual domain name. That name is currently in ws.surbl.org, sc.surbl.org, and ob.surbl.org, but none of the rules fire on this message.

--
Kelson Vibber
SpeedGate Communications <www.speed.net>

Reply via email to