In message <4e8853e99dsteve.pampling@xxxxxxxxxxxxx> Steven Pampling <steve.pampling@xxxxxxxxxxxxx> wrote: > Possibly significant is that the deboras and the single subject spams > currently around seem to have a specific pattern of hex-derived digits a > dollar sign 8 hex digits and then a dollar sign then more hex until the @ > > Common in the first block is 01c70 > > I'm wondering if the numbers represent something in the botnet they are > part of... IIRC this sort of number is characteristic of having been originated by one of Microsoft's programmes. Part of it is the date; you will eventually see the above number increment. I'd suggest that it probably isn't helpful. A few months ago, I tried using it as a rule, but very soon had to give it up. Dave