URL construct in spam

[Gerard]

On Sun, 27 Jul 2008 19:45:03 +0200
Hugo van der Kooij <hvdkooij at vanderkooij.org> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Hi,
> 
> It seems there is no SA detection yet of this construct I see on spam
> which usually has litte else added in terms of specific hits:
> 
> - - Visit our site:  [DxT]com
> (copy this link then replace "[DxT]" to "x")
> 
> I removed the actual bit of the website before the [DOT] so we shall
> give them no extra customers.
> 
> But these seem to float around quite a bit.
> 
> Hugo.

That little piece of code was being picked up with Sanesecurity
signature: Email.Spam.Gen3427.Sanesecurity.08061007

I have changed the "." and the "O" to an "x" above so it will not get
caught by clamav again.

-- 
Gerard
gerard at seibercom.net

Serfs up!

	Spartacus