MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii In message <81df6a884e.davehigton@xxxxxxxxxxxxx> Dave Higton <davehigton@xxxxxxxxxxxxx> wrote: > In message <4e8853e99dsteve.pampling@xxxxxxxxxxxxx> > Steven Pampling <steve.pampling@xxxxxxxxxxxxx> wrote: > > > Possibly significant is that the deboras and the single subject spams > > currently around seem to have a specific pattern of hex-derived digits a > > dollar sign 8 hex digits and then a dollar sign then more hex until the @ > > > > Common in the first block is 01c70 > > > > I'm wondering if the numbers represent something in the botnet they are > > part of... > > IIRC this sort of number is characteristic of having been originated > by one of Microsoft's programmes. Part of it is the date; you will > eventually see the above number increment. I'd suggest that it > probably isn't helpful. A few months ago, I tried using it as a > rule, but very soon had to give it up. > > Dave > - and I've used the 5 before the "@" very successfully until I discovered I'd been deleting a couple of entirely trustworthy sources as well... -- E.Mark Jolliffe www.poppy-land.co.uk