Typical spam not detected at all.. there is no rule for it :-\

[David Velásquez <da...@conexcol.com>]

Spam detection software, running on the system "co3.conexcol.com", has
identified this incoming email as possible spam.  The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email.  If you have any questions, see
abuse@conexcol.com for details.

Content preview:  US Oil and Gas Report Oi| C|imbs, Gains Soar We have
  the |eading track record for finding fast moving, Low-priced energy
  plays. Look at the moves made by our last 2 Hot Picks: SPRL .14 to .36
  in 12 days, up 157% PRVB .10 to .265 in 8 days, up 165% [...]

Content analysis details:   (-2.6 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
-2.6 BAYES_00               BODY: Bayesian spam probability is 0 to 1%
                            [score: 0.0000] 

Re: Typical spam not detected at all.. there is no rule for it :-\

[Stuart Johnston <st...@ebby.com>]

Duncan Hill wrote:
> 
> works like a charm, and RM should be adding a SARE rule that catches that 
> email address at the bottom.  The numbers change, but the prefix is good, as 
> is the suffix.

Here's mine:

body L_STOX /stox\d{4}\s{0,4}\@\s{0,4}yahoo.com/

Re: Typical spam not detected at all.. there is no rule for it :-\

[Duncan Hill <sa...@nacnud.force9.co.uk>]

On Wednesday 02 March 2005 18:45, David Velásquez wrote:
> Content preview:  US Oil and Gas Report Oi| C|imbs, Gains Soar We have
>   the |eading track record for finding fast moving, Low-priced energy
>   plays. Look at the moves made by our last 2 Hot Picks: SPRL .14 to .36
>   in 12 days, up 157% PRVB .10 to .265 in 8 days, up 165% [...]

Some days, custom rules are good things.  RM (I think, sorry, email is in 
other box) has some that pick these up.  The rule

body    STOCK_SPAM2 /If you wish to stop future mai[l|\|]ings, or if you 
fee[l|\|] you have been wrong/

works like a charm, and RM should be adding a SARE rule that catches that 
email address at the bottom.  The numbers change, but the prefix is good, as 
is the suffix.