[Spambayes] Latest spammer trick stymied - QUESTION

[bill parducci]

Tim Peters wrote:
>>>  url:check.myspam.com
>>>  url:check.myspam.com/ad
>>>  url:check.myspam.com/ad/junk
> 
> Those are probably one-shot hapaxes (i.e., worthless, except for catching
> copies of the same spam).  If you own a domain xyz.com, then you can make up
> all the ABC.xyz.com targets you like, and spammers generally do.  ABC
> doesn't repeat often except in copies of the same spam.

empirically i am not so sure. below are links that have been arriving 
daily in my trolling account (each listed twice per note, one supposedly 
in case you are having problems with the other):

http://www.nudesletter.com/schoolgirl-FEB/index.html
http://www.nudesletter.com/auditions-SC/index.html
http://www.nudesletter.com/8thstreet-ND/index.html
http://www.nudesletter.com/multi-FEB/index.html
http://www.nudesletter.com/russians-WG/index.html

while the goal is the same (traffic to www.nudesletter.com), each day 
the url changes. there are a number of other spam threads that work 
similarly.

>>therefore, in the case of url parsing, it would seem that less
>>[granularity] is more [accuracy].
> 
> Test and measure.

you left off 'write code' before 'test and measure'. i am still coming 
up to speed there so for me this will have to stay in the theoretical 
for the time being.

b