Detecting Hashbusters, 2 It's a time-based value again; the spamware uses (time(NULL) / 4444) as a "random" value Received: from 141.157.102.28 ... for ; Wed, 8 Sep 2004 00:48:18 +0100 (IST) From: 246309@hotmail.com 246309*4444 = 1094597196 = Tue Sep 7 15:46:36 2004 Always has this kind of offset, less a day or two; it's when the spam run started