Stephen:
The following rule would have caught both of my sample spam messages. Would these catch the other spams you've seen from this spammer... or has he varied this up in other e-mails to prevent this rule (alone) from catching him:
(case sensitive) %LETTER</STRONG></BIG>,<STRONG><BIG>%LETTER</BIG></STRONG>]></FONT>
1) %LETTER = a random letter 2) everything else is literal
Also, I found that that domain script generated 1,300+ domains. I've decided that the added resources of checking each message for this many domains is not worth it based on how many will actually be caught. However, I might integrate this domain list "*namefromlist*.org" as a factor in a compound rule.
Rob McEwen