I have found a pattern in our snowshoe spam. The messages contain a link with .work as the TLD. Here is a RegEx I put in our Keyword filter that stops all of it. I also added .country and .kim as those are reccomended to be blocked.
If you deal with any legit sites that end with .work then of course this will block those. We don't so it works out well for us.
Feel free to use this or tweak it however you want.
((?i)(http(s|):)\S+\.(work|country|kim)(\/\S+)?\b)(\/|)\s
This thread was automatically locked due to age.