Freqs for those rules in 'mc-fast' mass-check:
  MSECS    SPAM%     HAM%     S/O    RANK   SCORE  NAME
      0     1996     1999    0.500   0.00    0.00  (all messages)
0.00000  49.9625  50.0375    0.500   0.00    0.00  (all messages as %)
0.00000  41.1323   0.0000    1.000   1.00    0.01  T_PQRTW_4

Could it possibly be I just created a killer rule to identify > 40% spam with no false positives? Seriously low scoring spam. Using a single, really short RE? Could it possibly be there is one major spammer out there, that uses this easy to catch finger print on all his spam? And that no one spotted it before…?

Granted, that’s just a tiny pre-flight corpus used for some very basic, fast evaluation. Eagerly awaiting the real mass-check results tomorrow…

I guess, coming up with a few rules that seriously hit low-scoring spam, while resulting in a (less than) negligible amount of false positive hits triggers some attention. The style of arguing and dealing with the developers may have helped, too. Anyway, I am now one of these developers myself. Yay me.

Unfortunately, ever since I’ve been granted this status, I didn’t have the time nor sufficient sneaky spam to develop new rules. Until now. Spotted a pattern yesterday night, and hacked up some rules — turns out, this is a new ratware variant, no hits older than a week. I expect more of these, soon.

Thanks guys (you know who you are). Access to the nightly mass-checks is just awesome to check a rules performance in development.