Taking a quick look at the first one (and I wish you would post as text
rather than html next time!) I see some interesting things that will
probably hold for some time:
1. www.snapshut.info should be added to the BigEvil list
2. The word "logo" or "Logo" appears 8 times in the body of the message.
Suspicious.
3. The word "Iogo" (capital I, not L) appears twice, intended to be
obfuscation.
4. The word "Ioqo" (capital I, q instead of g) appears once as
obfuscation.
5. The word 'quality' is spelled "guaIity", again intended as
obfuscation.
Taken together, these can make some fairly nice rules specific to this spam.
body __LOGOS /(?:\blogo[s]?\b){6,99}/i
body __BAD_LOGOS /\bIo[gq]o[s]?\b/
body __POOR_QUALITY /gua[lI]ity/
meta NASTY_LOGOS (__LOGOS && (__BAD_LOGOS || __POOR_QUALITY))
score NASTY_LOGOS 5.0
uri SNAPSHUT /www\.snapshut\.info/
score SNAPSHUT 2.0
Loren
