Hi, These are the common elements as far as I can see in the text/plain part of the spam:
1) The URL always matches this regex: http://\S+/\S+\.\s+\? In other words, there's always a dot in the URL (not counting the dots in the domain name itself) and a question mark. 2) The URL is then followed by possible whitespace and the name or address of the sender. 3) This is followed by more possible whitespace and then the date and time in a format that matches this regex: \d{1,2}/\d{1,2}/\d{4} \d{1,2}:\d{1,2}:\d{1,2} [AP]M Can others confirm this pattern? Regards, David.
