Millions and Billions

[Stuart Johnston <st...@ebby.com>]

I've been seeing a ton of stock spam this week, no URLs - no SURBL :( 
Bayes and Razor, etc pick up on it eventually but to speed things up, I 
wrote a rule.  One thing that is unique about these messages is that 
they replace l's with |'s.  They usually will have some variation on 
Mil|ions or Bi|lions.  Here is the rule I came up with:

body L_MILLBILL /[mb]i(?:\|l|l\||\|\|)ions?/i

Feel free to use it, make suggestions or point out that I wasted my time 
writing a rule already available from SARE.

Stuart Johnston

Re: Millions and Billions

[Duncan Hill <sa...@nacnud.force9.co.uk>]

On Thursday 24 February 2005 21:54, Stuart Johnston wrote:
> I've been seeing a ton of stock spam this week, no URLs - no SURBL :(
> Bayes and Razor, etc pick up on it eventually but to speed things up, I
> wrote a rule.  One thing that is unique about these messages is that
> they replace l's with |'s.  They usually will have some variation on

The one thing I have seen in every stock spam over the past 2 weeks is that 
the e-mail address in the footer is stox???? @yahoo.com, where ? is a number.  
Rather nice present from the spammer.