Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

New Spam (with Job on its subject) that IPAS could not catch

I notice there's a new spam that could not be catched by IPAS:

Sample Spam:
----------------------------
Date: Tue, 30 May 2006 09:35:45 +0800
From: Rolland Dick <672stephan@kotnet.org>
To: yahya@cbn.net.id
Subject: Fwd: Job
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
X-SBRS-Score: 0.4

Hey Yahya

Are you energetic, honest and responsible?
Are you a student looking for extra income? Are you retired but sill willing to work?
Or maybe you are just looking for a way to make a few extra bucks?

Ask us! We have great job offer for you.


Please contact us to get more information.
Our e-mail: support@tollis-catalogue.com
________________
Jeanine Christensen
Tue, 30 May 2006 09:35:45 +0800
----------------------------

From mail_logs:

mail.ip1.@20060530T062622.s:Tue May 30 07:12:26 2006 Info: MID 149935855 Subject 'Re: Job'
mail.ip1.@20060530T062622.s:Tue May 30 07:16:05 2006 Info: MID 149936948 Subject 'RE: Job'
mail.ip1.@20060530T071635.s:Tue May 30 07:17:20 2006 Info: MID 149937465 Subject 'Fwd: Job'
mail.ip1.@20060530T071635.s:Tue May 30 07:17:23 2006 Info: MID 149937480 Subject 'Re: Job'
mail.ip1.@20060530T071635.s:Tue May 30 07:17:27 2006 Info: MID 149937503 Subject 'Job'

I have already submit some of them to TOC and stil trying creating
a filter to block them.

Anyone already able to overcome this? Perhaps filter to share this randoms email address on the body?

TIA
_________________
--
A. Yahya Sjarifuddin.

1 REPLY
New Member

Do all of them have the same email address in them

If so as a message filter:

Catch_Jobs: if (subject == "(?i)job") and (body-contains("(?i)tollis-catalogue.com")
{
drop();
}

187
Views
0
Helpful
1
Replies
CreatePlease to create content