Here's another version. This successfully recognises all four of your examples and doesn't fire on any of my other spam test messages:describe MG_TWOLETTER_OBFUSCATION Two letter obfuscation (X:X X :X)) header MG_TWOLETTER_OBFUSCATION Subject =~ /[A-Z][:%~;^][A-Z]\s{0,1}[:%~;^][A-Z0-9]/ score MG_TWOLETTER_OBFUSCATION 5.0 This rather longer regexp was wrapping when pasted into this reply, so I split the line at 'Subject' for clarity. Martin
I looked over my old spam logs, and I'm finding hits from this rule. All I did was add a few extra characters that some spam were using. This is working good now. Thanks.
