I just tested the new assp.pl 126.96.36.199 (0.0.09)
features and the concept of a total scoring value
as the sum of all valences(weights) of all found Regex is really nice.
It worked very well.
It will be wonderful if the concept can be
extended to all remaining spambomb regular
expression filters because about 100% of regex in
the BlackRe are really strict and
(blackReMaxHits) is going to be 1 in most cases.
However, there are lots of weaker "suspicious
phrases" that when present together in the same
mail will really assure it is a spam.
I always notice in my server that the Nigerian
(419) fraud are very successful to pass trough
ASSP because they are almost always sent by well
configured mails servers with valid mail accounts
and plain English text. They use phrases that
could be in any valid mail, but they do have an
"accent" (similar to what you notice when I write
in English, you may not be sure that I am
Brazilian, but you notice that my native language is not English)
Examples: (I used underscores bellow to let this mail pass my on filters)
All of the above phrases are plain English, but
they are unusual, so alone, they are nothing more
than suspicious worlds, but if they come together
in the same mail than it is highly probable that this is a
Nigerian 419 advanced fee fraud
All the Best
Hilário Fochi Silveira