I've been seeing a ton of stock spam this week, no URLs - no SURBL :( Bayes and Razor, etc pick up on it eventually but to speed things up, I wrote a rule. One thing that is unique about these messages is that they replace l's with |'s. They usually will have some variation on Mil|ions or Bi|lions. Here is the rule I came up with:

body L_MILLBILL /[mb]i(?:\|l|l\||\|\|)ions?/i

Feel free to use it, make suggestions or point out that I wasted my time writing a rule already available from SARE.

Stuart Johnston

Reply via email to