Out of curiosity, if you have the spare machine time, could you test the
simple rule
uri AFF_ID /\/\?AFF_ID\=/
describe AFF_ID URL contains AFF_ID=
score AFF_ID 3
This has been working well for me for a couple days, but I really don't get
a huge quantity of messages. I'm interested if it hits any ham at all.
Also, up to today this one has been catching lots of spam for me, although
interestingly today I haven't had a single spam matching this pattern.
Normally it catches 30-40 a day.
uri URL_EQUALS /www\.[0-9a-z\.\_]+\=[0-9a-z\.\_]+/i
describe URL_EQUALS URL has equal sign in hostname
score URL_EQUALS 4.4
Thanks,
Loren
