Hi there This piece of spam got into my inbox
http://pastebin.com/n9QaffWD It made me think: it contains links to the site it wants you to go to (which are all the same) - but includes a fake unsubscribe option that refers to the same URL. I've seen this behavior in a tonne of spam... How much work would it be to create a rule that detects "unsubscribe" links, and scores it up if it has the same URL as seen elsewhere in the body? Real messages wouldn't do that...? -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
