On 04-04-2012 11:26, Jason Haar wrote:
Is this the format being referred to? These are consistently getting
through SA for us too
http://pastebin.com/VHkfnTtm
Jason
On 01/04/12 10:05, John Hardin wrote:
On Sat, 31 Mar 2012, joea wrote:
On 3/31/2012 at 8:22 AM, Michael Scheidell
<michael.scheid...@secnap.com>
wrote:
if you need help, you need enough full information.
Or, you make the pastebin 'private', and send the link offlist to
someone who has volunteered to help. . . . .
If there are more volu nteers, beyond the presumed one . . . feel free
to . . .
joea sent me the messages. It appears his bayes isn't running at all,
they got no BAYES_## hits whatsoever.
The URLs in them also have a really suspicious form; I've added a
couple of rules for that to my sandbox. I suspect that the form is
really uncommon, though, perhaps just fat fingers by this one spammer,
so I doubt they will do well in masscheck. We'll see...
I had a similar thing here which these domain anonymizers seems to pass
through SA so I got this from Robert Schetterer on the SA user list to
this site AnonWhois to help score these domain anonymizers
http://anonwhois.org/usage.html. This with Spam Eating Monkey does help
with SA scoring this junk as spam http://spameatingmonkey.com/index.html.
I hope this helps,
Frank
