I've seen many "stock advisory" spams slip through recently. They tend to have >From lines like this:
From: Investor Offers <[EMAIL PROTECTED]> Anyone think this is worth a rule? I would think both "investor" and "offers" (or either separately) would be a good spam indicator, but I'm curious whether the GA would agree. Here are a bunch of phrases from the message body that might also be possibilities: special offer the offer below investor offers FDIC Insured This also appears to be connected (whether with their knowledge or not) to DoubleClick, the relatively respectable banner-ad company. Here's a "remove" URL from the message: http://ad.doubleclick.net/clk;3824278;6743144;o?http://home.ingdirect.com/promo /promo_set.asp?p=%9BURdVw%AC. I've only seen two of these so far, but maybe a "lots of numbers in URL" rule would be a good idea. -- michael moncur mgm at starlingtech.com http://www.starlingtech.com/ "Of those who say nothing, few are silent." -- Thomas Neill _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
