> -----Original Message----- > From: Stuart Johnston [mailto:[EMAIL PROTECTED] > Sent: 13 April 2005 21:42 > To: Andreas Davour > Cc: users@spamassassin.apache.org > Subject: Re: Need for a new rule? > > Andreas Davour wrote: > > > > The following message have many characteristics in common with much > > spam I've been getting lately. It's about investments, > often shares, > > stock options or oil. One odd thing about those messages is > that they > > all, like the one quoted below, have the letter 'l' substituted for > > the pipe character i.e. '|'. > >
Here we have a large number of obfuscated word rules, including a number that are related to stocks and shares. We need to be careful as we do receive legitimate 'forrrward loooking statements' (obfuscated in case you don't like the phrase) so tend to have things like (?!millions?)m[1i|][l1|][l1|][l1|][0o]n[5s]? (not checked) The basic rule is that real people don't try to hide what they are saying. There does exist a problem with other companies who use profanity filters. The sender beats their profanity filter by obfuscating the word, and we catch it because they obfuscated! --------------------------------------------------- This email from dns has been validated by dnsMSS Managed Email Security and is free from all known viruses. For further information contact [EMAIL PROTECTED]
