> There have been several threads about this specific spammer
> in the last
> few months. Some of them with this exact question - mostly
> the answer
> is no.
>
> > e mail with No Thanks in the subject to st0ck62 @ yahoo.com
>
> It is much easier to match on this email address with something like:
>
> body L_STOX2 /st0ck\d{2}\s{0,[EMAIL PROTECTED],4}yahoo.com/i
>
That is what I do to foil this particular spammer. Hope he doesn't
change is fake email address ;)
I get millions (mil|ions?) of spams from this guy (well, not millions,
but I have recieved 15 in the last 2 hours).
While generic tests for character/letter obfuscation are difficult, this
guy is pretty predictable.
body SRH_PENNY2 /(?:e\s*mai\||mi[|l]{2}ions|resu\|ts|wi[|l]{2})/
Add your own l->| words to this list, although he hasn't failed to use
one in the list above in each one of his spams.
-steve
