Ideas for the space.live.com spam?

[asjawebmaster]

Anyone have any ideas for dealing with the spaces.live.com spam?

We are getting bombarded with these, eg:

"the most trusted online casino

http://cid-24c2fccf26c4099b.spaces.live.com/"

the URL always changes

the originating IP always changes

the spam assassin score is always too low to lower the threshhold

I've reported a huge number of these to Microsoft, which apparently does nothing.

If there was a way to filter on spaces.live.com in the message body, I'd do that, but I do not see any way to do that with the custom spam filters.

[Andilinks]

I don't have any ideas but since this question has gone unanswered for about 22 hours I think I'll kick it back up to the top.

I'm getting a lot of these too.

[Tom E.]

If there was a way to filter on spaces.live.com in the message body, I'd do that, but I do not see any way to do that with the custom spam filters.
Here's a recent thread on the subject:
Custom Filter to delete everything UNLESS containing specific pattern in body (http://www.aota.net/forums/showthread.php?t=23755&highlight=filter+body)

[asjawebmaster]

The spaces.live.com spam has now changed to the livefilestore spam.

The following seems to work to detect "livefile" in the body:

if grep -iq 'filestore'; then exit 99; fi

It is set as a simple filter.