>...
>Greetings:
>
>While it has never been pleasant, we regularly review spam including the
>HTML source code behind the spam to help us adjust our system-wide spam
>tagging rules.
>
>We've noticed a lot of sick porn spam being left untagged.
>
>The tests that raised the score, though not high enough were as follows:
>
>HTML_IMAGE_ONLY_12,HTML_MESSAGE,MPART_ALT_DIFF
>
>These tests are too generic to raise the score higher through customization.
>
>However, I did notice in the HTML source code a common theme:
>
>
><IMG
>src="http://yamanekohm.com/9d70188c4e7971b6d3b1e2fa8/Nf3KZuBf0T/file_name";
>alt="rundowns" border="0"><BR>
><IMG src="http://yamanekohm.com/9d70188c4e7971b6d3b1e2fa8/file_name";
>border='0'><BR>
><IMG src="http://yamanekohm.com/9d70188c4e7971b6d3b1e2fa8/Y/eZ/file_namef";
>alt="ouch" border="0"><BR>
>
><IMG src="http://tatighk.com/ae3019e288e5a5902958a62de/IWutqQ/filename";
>border=0><BR>
><IMG src="http://tatighk.com/ae3019e288e5a5902958a62de/filename";
>alt="Antipas" border=0><BR>
><IMG
>src="http://tatighk.com/ae3019e288e5a5902958a62de/fT66kl/KK0tcw71p/filename";
>alt="strengthen" border=0>
>
>
><IMG src="http://muoniofgj.net/6481ddc2353481dae6c63affa/YriLMz/filename";
>border="0"><BR>
><IMG src="http://muoniofgj.net/6481ddc2353481dae6c63affa/filename";
>border='0'><BR>
><IMG src="http://muoniofgj.net/6481ddc2353481dae6c63affa/txU/t1q/filename";
>border=0>
>
>
>Where the common theme appears to be the directory structure right after
>the domain name.
>
>For the pattern experts out there, is there a way to craft a regular
>expression to catch the directory pattern used?
>
>Specifically the directory pattern right after the domain name.
>
>Thank you.
>________________________________________________
>Peter M. Abraham
>Support and Customer Care Department
>Dynamic Net, Inc.
>Helping companies do business on the Net
>420 Park Road; Suite 201
>Wyomissing PA 19610
>Toll Free Voice: 1-888-887-6727
>International: 1-610-736-3795
>FAX: 1-610-736-3798
>Support Email: [EMAIL PROTECTED]
>Company Email: [EMAIL PROTECTED]
>Web: http://www.dynamicnet.net/
> http://www.wemanageservers.com/
>________________________________________________
>
>
These are part of the same porn/spam group that came up yesterday.
They are using a new person's name in Texas (again) "GEORGE BAKER". Also,
note that Joker (again) has identified the (new)registration address as
invalid (just like all the previous ones). Any 'whois' will show the name
servers:
NS1.ANWOO-munged.COM
NS1.BOMOFO-munged.COM
NS1.EPOBOY-munged.COM
NS1.MYNAMESERVER-munged.CA
Paul Shupak
[EMAIL PROTECTED]
P.S. Time to implement Bugzilla #4106 (maybe I'll get some time this weekend).
