Marian,
For these stock scams, bayes is your friend; Parsing it locally I get
Content analysis details: (3.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.1 MISSING_HEADERS Missing To: header
1.9 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
[score: 1.0000]
1.2 MISSING_SUBJECT Missing Subject: header
Which still isn't enough to trigger, but the message has the email
address of"stox0033@ yahoo.com", which someone (I forget who) pointed out
earlier this week or last that they were seeing all stock scams with email
of the form "[EMAIL PROTECTED]". Bayes training together with a rule for that
email pattern in the body, you should catch them -- They key for me is that
the stock scams seldom have enough header points to "autolearn" for bayes
and must be hand trained; Still they all have so many common tokens, that
the BAYES_99 I see is quite different than the BAYES_OO you see. Also,
quite a few people have mentioned that they have increased the score for
BAYES_99; I use the stock install myself with only a set of custom URI rules.
A good regexp for the email would probably be something like STOX_YAHOO \
[EMAIL PROTECTED] and a point count of only 1.8 or 1.9 would cause a trigger.
Note: This clearly would/should be a temporary rule as it is unlikely the
spammer would be so dumb as to continue the pattern. Also, I think Rules du
Jour and SARE have some stock rules which I don't use that would catch these
even better. (I'm sure someone else on the this list knows better than me.)
Good luck,
Paul Shupak
[EMAIL PROTECTED]
P.S. I didn't check the validity of the email as I usually do, but if valid,
mail to Yahoo! with a copy of the spam will cause the account to be revoked,
