Steve said: >Just checking to see if anyone has seen >this problem and written a rule to score these emails
I don't actually use SpamAssassin. I use another program. But I subscribe to the list for ideas and trends. I use another spam filter which, like SA, is also extensible. In this other program, I wrote a custom rule which I've pasted at the end of this message. You may want to cut and paste this into a text editor for better viewing. Also, notice that the collection="text_packed" statement refers to the fact that the text was stripped of all spaces and punctuation before processing by this rule. Finally, the "/|" in the regular expressions would be "|" in most programs (logical "or"). I haven't updated this Investment Spam Rule in a few months. I've noticed many such spams making it past this custom rule which use more letter obfuscation. I'm itching to update this to take advantage of such (i.e. "sma|| caps")... but I haven't had the chance to make such improvements (yet). Perhaps you could use what I've done as a starting point for writing the SA rule. Rob McEwen <rule result="reject_InvestmentSpam"> <title>phrases found in investment spam</title> <scope> <header>all</header> <body>all</body> </scope> <expressions collection="text_packed" oninit="unique=0;score=0;notspam=0" logic="return ((score >= 8) && (unique >= 7) && (notspam == 0)) || ((score >= 12) && (unique >= 6) && (notspam == 0)) || ((score >= 15) && (unique >= 5) && (notspam == 0))"> <expression collection="original" casesensitive="no" type="regex" onfirstmatch="unique += 2" onmatch="score += 1">\((Nasdaq\|NYSE): \w+\)</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">(%\|percent) *equity</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">52wkRange</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 2" onmatch="score += 1">Advertiserisbeingpaid</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">ActQuickly</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">alternativetobluechips</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">astuteinvestors</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">attentionfromaroundtheworld</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">BeforeInvesting</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">BelievedToBeReliable</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">bestpick</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">bigPRcampaign</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">Bigyearexpected</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">breakingnews</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 2" onmatch="score += 1">buyrecommendation</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">businesswire</expression> <expression collection="original" casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">CityBrokers</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">Compan(y\|ies)ToWatch</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">conflictofinterest</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">CurrentPrice</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">currentlytrading</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 2" onmatch="score += 1">discloses?thereceipt</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 2" onmatch="score += 1">discloses?theholding</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">dontmiss</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">dontsleep</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">DueDiligence</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">earningsofapproximately</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">earningsgrowth</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">earningsestimates</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">emergingcompany</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">EmergingGrowth</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 2" onmatch="score += 1">EmergingStock</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">entireinvestment</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 2" onmatch="score += 1">EquityAlert</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">expansionplans</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">Expect(some\|strong\|somestrong)Demand</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">expected?toexplode</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">expected?tomake</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">expected?tosurge</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">expecthugecoverage</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">explosivelyprofitable</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">FellowInvestors</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">Firsttimeinvestors</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 2" onmatch="score += 1">foorward</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">formalannouncement</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">(forward\|future)lookingstatements</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">GalinaBreakingNews</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">GalinaNews</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">GoingToFly</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">greatdemand</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">GroundBreaking</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">growingatarapidrate</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">goodluck</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 2">goodnewsjustkeepsoncoming</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">GrabthisHOT</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">greatprofits</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 2" onmatch="score += 1">growthstockreport</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">hasacquired</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">HighDegreeOfRisk</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">HotTradingAlert</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">HugeTradingAlert</expression> <expression collection="original" casesensitive="no" type="regex" onfirstmatch="unique += 2" onmatch="score += 1">High-projection:</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 2" onmatch="score += 1">(hasbeen|\willbe)compensated</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">heldcorporation</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">historyofgrowth</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">historyofsteadygrowth</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">hotnewissue</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">increasedexposure</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">increaseitsmarketpresence</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">IntentToProfit</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">investmentexpert</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">IsExploding</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">jointventure</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">largePRcampaign</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 2" onmatch="score += 1">letterwaspaid</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">liquiditywillincrease</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 2" onmatch="score += 1">loooking</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">lossofyour</expression> <expression collection="original" casesensitive="no" type="regex" onfirstmatch="unique += 2" onmatch="score += 1">Low-projection:</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">MarketPotential</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 2" onmatch="score += 1">marketishot</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">marketstandout</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">MustActQuickly</expression> <expression collection="original" casesensitive="yes" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">Name_of_stock:</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">newsalert</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 2" onmatch="score += 1">newsletterwaspaid</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">newsrelease</expression> <expression collection="original" casesensitive="yes" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">NEWS:</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">onthemove</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">openingprice</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 2" onmatch="score += 1">OTCNews</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">outstandingshares</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">PaidAdvertisement</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">PaidAFee</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">paidprofile</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">Pastperformance</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 2" onmatch="score += 1">pennystock</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 2" onmatch="score += 1">PinkSheets</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">poised</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 2" onmatch="score += 1">PRcampaign</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 2" onmatch="score += 1">pressreleasesource</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">privatelyheld</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">profiledcompany</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">profitabilitysoon</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">Potential</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 0.5">Projections</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">publicfloat</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 2" onmatch="score += 1">publisher(hasbeen|\willbe)</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">rapidgrowth</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">RatingUndervalued</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">ReasonsToBuy</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">recentpressrelease</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">RecentPrice</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">RecentNews</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 2" onmatch="score += 1">RecommendationBUY</expression> <expression collection="original" casesensitive="no" type="regex" onfirstmatch="unique += 2" onmatch="score += 1">RECOMMENDATION: ?STRONG_BUY</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">recordhigh</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 2" onmatch="score += 1">risingstar</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">settoexplode</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 2" onmatch="score += 1">ShortTermTradingProfits</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">SmallCap[^i]</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">soared</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">speculativeBUY</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 0.3" onmatch="score += 0.3">specialcompany</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">startearningmoneyNOW</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">startearningmoney</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">stellarstock</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 2" onmatch="score += 1">Stocck</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 2" onmatch="score += 1">St0x</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">StockSymbol</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">StockRating</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">stockwillexplode</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">StrongBuy</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">strategicalliances</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">SubstantialPosition</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">thereceiptof</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">thirdpary</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">ThisIsYourChance</expression> <expression collection="original" casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">Ticker:</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">ToBeProfiled</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">TradingAlert</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 0.5" onmatch="score += 0.5">UniqueProduct</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">unmatched</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">ValuedPrice</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">VerifyAllClaims</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">Weexpect</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 2" onmatch="score += 1">wehavebeenpaid</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 2" onmatch="score += 1">wewerepaid</expression> <expression casesensitive="no" type="regex" onfirstmatch="unique += 1" onmatch="score += 1">WallStreet</expression> </expressions> </rule>
