On Thu, 2010-03-11 at 07:55 -0600, Dennis B. Hopp wrote: > I'm going to look at what Martin suggested and compare it to what > samples I have. > FWIW, I have 2 or three portmanteau rules that are effectively collections of misspelled words (such as v1agra, improove, ...), medspamming phrases, throwaway URI patterns, etc that I've built up from a number of spams. All are scored low (around 0.01) so I can see them fire but with little impact in the overall score. I use them in meta-rules with rather higher scores. This approach is surprisingly effective at catching previously unseen spam, due to spammers not being very creative when it comes to generating readable misspelled words or their insistence on continuing to send spam via inappropriate channels, such as technical mailing lists.
Martin
