Odd subject line spam

[Matt Thoene <ma...@remedyx.com>]

Hello,

We're seeing quite a few spam emails with subject lines similar to the
below...

"Better st0ck perfOrmance fr0m 0tc helpline"

Does anyone have a rule for these yet?

-- 
Regards,
 Matt                         

Re: Odd subject line spam

[Loren Wilton <lw...@earthlink.net>]

> > "Better st0ck perfOrmance fr0m 0tc helpline"
> >
> > Does anyone have a rule for these yet?
>
> There are rules for those, however, they only seem to exist for the body.
> Mangled, Chickpox and SARE_adult all hit on that line.

But keep in mind that body rules also get fed the Subject, so they will
catch this stuff there too.

Body rules won't catch this sort of thing in from/to/received type headers.
But in this particular case, it is fairly unlikely that those would be
obfuscated in this way.

        Loren

RE: Odd subject line spam

[Sander Holthaus - Orange XL <in...@orangexl.com>]

> Hello,
> 
> We're seeing quite a few spam emails with subject lines 
> similar to the below...
> 
> "Better st0ck perfOrmance fr0m 0tc helpline"
> 
> Does anyone have a rule for these yet?
> 
> --
> Regards,
>  Matt                         
> 

There are rules for those, however, they only seem to exist for the body.
Mangled, Chickpox and SARE_adult all hit on that line.

Kind Regards,
Sander Holthaus