I've been experimenting with rules to catch "BIZ_WIZ" style email addresses where it's a compound email address composed of related parts, usually in grammatical order. New spammers seem to adopt the same basic formula from time-to-time, so it should be possible to catch them too. For example:
stock.*advisor financial.*wizard otc.*journal etc. I'm not sure which of these rules will be more effective in practice (feel free to tweak), but here they are: /\@/ && /(biz|otc|stock|financ(e|ing|ial)|invest(or|ment)?|market)/ && /(advisor|journal|alert|wizard|player|offer)/ /\@/ && /(stock|financial|otc|market|customer|business|special|alert).*(advisor|journal|info|player|service|offer|trade|biz)/ Here's the longer list of keywords that seem to work to some extent. The count is how often they're found in combination with each other (alone doesn't count), but I have a limited number of spam messages to test. I think the trick is in how well you combine them. If you get too aggressive, you start matching etrade messages, but I guess that's where the scoring comes into play. :-) 138 advisor 114 stock 112 info 79 journal 62 excite 50 financial 47 offer 46 otc 40 player 31 service 31 alert 29 market 20 customer 20 biz 19 business 18 special 17 trade 10 support 9 vacation 9 money 8 finance 7 investor 7 credit 5 account 4 travel 4 investment 3 merchant 2 payment 2 invest 1 wizard 1 success 1 savings 1 promotion 1 profit 1 commercial 1 commerce - Dan _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
