a.) Tracker_ID
Looks for a message-tracking ID number in the body, generally a base64 encoded number at the bottom:
# this seems to be the new fashion (as of Jul 5 2002). base64-encoded parts need to
# be stripped before this match
body TRACKER_ID /^[a-z0-9]{6,24}[-_a-z0-9]{12,36}[a-z0-9]{6,24}\s*\z/is
describe TRACKER_ID Incorporates a tracking ID number
b.) Subject Has a Unique ID
Looks for subjects with unquie ID strings at the end of them.. You know, the ones where there's a bunch of spaces and a garbled alphanumeric at the end, 20 spaces or so away from the real subject.
Things like this:
Subject: Need help with Mortgage or Debt? get a F-R-E-E rate! NO ONE IS DENIED! pR7oo9j
(note: I've not verified the above spam matches, but the pR7oo9j is the unique id.)
Both of these are used to help spammers track their spams and see which ones get reported to places like spamcop or NANAE. They then can start figuring out who to joe-job from that.
It's also helpful in avoiding very simple filters (ie: razor1, which didn't use ephemeral hash like razor2 does)
