I've been seeing a ton of stock spam this week, no URLs - no SURBL :(
Bayes and Razor, etc pick up on it eventually but to speed things up, I
wrote a rule. One thing that is unique about these messages is that
they replace l's with |'s. They usually will have some variation on
Mil|ions or Bi|lions. Here is the rule I came up with:
body L_MILLBILL /[mb]i(?:\|l|l\||\|\|)ions?/i
Feel free to use it, make suggestions or point out that I wasted my time
writing a rule already available from SARE.
Stuart Johnston