I'm seeing a lot of these spammed to my Mailman mailing lists. They generally consist of a single line with an obfuscated URL and a couple of blank lines. The URL looks like "abcde . com" (ie. a space on either side of the dot).
If you post one or two somewhere I can write you a simple rule. I could write something from just what you described, but I'd be real concerned about the FP rate. If I see a couple messages I can probably do a little better.
Loren
