A few suggested new rules based on my review of some recent MLM spams:
body MAKING_MONEY /making money/i
describe MAKING_MONEY Discusses making money
There is a MONEY_MAKING rule already, but not "making money". They could be
combined, but based on recent discussions I wonder if separate rules are
better.
Then again, that one would be low-scoring since there could be false positives.
I think a more specific rule to catch phrases like "making money on the
internet" might score pretty well:
body MAKING_MONEY_INTERNET /making money.{10}internet/i
describe MAKING_MONEY_INTERNET Discusses internet money-making
Another MLM catch phrase that I can't imagine appearing in much legitimate
mail:
body GUARANTEED_MONEY /guaranteed to make money/i
describe GUARANTEED_MONEY Guarantees you'll make money
This one's probably iffy but it seems like a good low-scoring rule:
body RESIDUAL_INCOME /(?:supplemental|residual) income/i
describe RESIDUAL_INCOME Discusses supplemental or residual income
Lastly, I'm wondering if this change to the existing NO_SELLING rule would
work:
body NO_SELLING /no selling/i
describe NO_SELLING Claims not to be selling anything
The original regexp included the word "absolutely" but I've seen a few that
just say "No Selling" or "There's no selling involved". Also, the original rule
was case-sensitive and required "NO" to be in caps. These changes might result
in false positives, or at least a lower GA score, though.
--
michael moncur mgm at starlingtech.com http://www.starlingtech.com/
"I believe in getting into hot water; it keeps you clean."
-- G. K. Chesterton
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
