Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
New Member

New Spam (with Job on its subject) that IPAS could not catch

I notice there's a new spam that could not be catched by IPAS:

Sample Spam:
Date: Tue, 30 May 2006 09:35:45 +0800
From: Rolland Dick <>
Subject: Fwd: Job
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
X-SBRS-Score: 0.4

Hey Yahya

Are you energetic, honest and responsible?
Are you a student looking for extra income? Are you retired but sill willing to work?
Or maybe you are just looking for a way to make a few extra bucks?

Ask us! We have great job offer for you.

Please contact us to get more information.
Our e-mail:
Jeanine Christensen
Tue, 30 May 2006 09:35:45 +0800

From mail_logs:

mail.ip1.@20060530T062622.s:Tue May 30 07:12:26 2006 Info: MID 149935855 Subject 'Re: Job'
mail.ip1.@20060530T062622.s:Tue May 30 07:16:05 2006 Info: MID 149936948 Subject 'RE: Job'
mail.ip1.@20060530T071635.s:Tue May 30 07:17:20 2006 Info: MID 149937465 Subject 'Fwd: Job'
mail.ip1.@20060530T071635.s:Tue May 30 07:17:23 2006 Info: MID 149937480 Subject 'Re: Job'
mail.ip1.@20060530T071635.s:Tue May 30 07:17:27 2006 Info: MID 149937503 Subject 'Job'

I have already submit some of them to TOC and stil trying creating
a filter to block them.

Anyone already able to overcome this? Perhaps filter to share this randoms email address on the body?

A. Yahya Sjarifuddin.

New Member

Do all of them have the same email address in them

If so as a message filter:

Catch_Jobs: if (subject == "(?i)job") and (body-contains("(?i)")

CreatePlease to create content