You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Kirk Ismay <ki...@ismay.ca> on 2025/06/05 16:53:26 UTC
Finance / Tech spam
I'm trying to find a way to reduce a certain kind of spam that uses
sensational finance / technology subject lines. Typically Elon, Trump,
Tesla etc. It often slips through my ruleset. I've tried to create
local email and domain blocklists, as well as keyword rules based on the
mailing address in the body. Everything changes too frequently to be
able to keep up. They're using commercial email services like MailGun,
SendGrid, or Salesforce. None of the users I talk to have subscribed to
this sort of thing, and yet it's not all users that get this.
Any suggestions would be helpful!
Thanks, Kirk
Here are some sample subject / senders:
From: "Derek Langford | TVI" <ne...@tvi.tradevisioninsights.com>
Subject: Holy Grail of dividend stocks
From: "Cybertruck Stunt Video | 1st Market Leader"
<di...@1ml.1marketleader.com>
Subject: Watch Demo: Elon Musk’s New $9 Trilli
From: "Trump's Loophole Exposed | Chris Archer from CCA"
<da...@cc.cryptocurrencyadvices.com>
Subject: Elon’s IRS Attack Just Exposed a Trum
From: "Tesla Attack Exposed [Alan Brooks from SWP]"
<ne...@take.strategicwealthpro.com>
Subject: 🔴 Tesla Cybertruck Explosion: The Hi
Subject: This Tiny AI Firm Could Be Musk’s Real Play
From: Musk’s Hidden Play — Daniel Brown | GM He
Subject: Collect Thousands Monthly Without Paying Taxes!
From: "Social Security Check - William Carter [FMT]"
From: "Musk Stepping Down - Jacob Walker @ FMP"
<da...@financemarketprovider.com>
Subject: Trump and Musk at Odds: Financial Chaos Could Destroy Your
Retirement!
From: Trump’s crypto explosion, Emily Howard |
Subject: BREAKING NEWS: Trump’s crypto venture
From: "\"Elon sounds the alarm, Amanda S. From RITF\""
Subject: Elon Warns: Exec Order 14024 Targets Dollar
From: "Trump's Loophole Exposed | Chris Archer from CCA"
<da...@cc.cryptocurrencyadvices.com>
Subject: Elon’s IRS Attack Just Exposed a Trum
From: "Musk Stepping Down - Jacob Walker @ FMP"
<da...@financemarketprovider.com>
Subject: Trump and Musk at Odds: Financial Chaos Could Destroy Your
Retirement!
Subject: Collect Thousands Monthly Without Paying Taxes!
From: "Social Security Check - William Carter [FMT]"
Subject: This Tiny AI Firm Could Be Musk’s Real Play
From: Musk’s Hidden Play — Daniel Brown | GM He
From: "Tesla Attack Exposed [Alan Brooks from SWP]"
<ne...@take.strategicwealthpro.com>
Subject: 🔴 Tesla Cybertruck Explosion: The Hi
From: "Derek Langford | TVI" <ne...@tvi.tradevisioninsights.com>
Subject: Holy Grail of dividend stocks
Re: Finance / Tech spam
Posted by Bill Cole <sa...@billmail.scconsult.com>.
On 2025-06-05 at 18:54:09 UTC-0400 (Fri, 6 Jun 2025 00:54:09 +0200)
Tom Hendrikx <to...@whyscream.net>
is rumored to have said:
[...]
> Hi,
>
> I see some patterns like the recurring pipe and dash characters in
> From lines. But maybe you can share a few full messages with headers?
> Maybe there are easier ways to whack this mole.
+1
Subject and From headers simply are not adequate to figure out a
solution to a complex determination of a class of messages.
I can say that I see very few such messages making it to SpamAssassin,
so this is probably a case of specific few target addresses having found
their way onto a small number of mailing lists whose spammers are
"clean" enough to safely work through large ESPs.
--
Bill Cole
bill@scconsult.com or billcole@apache.org
(AKA @grumpybozo@toad.social and many *@billmail.scconsult.com
addresses)
Not Currently Available For Hire
Re: Finance / Tech spam
Posted by Tom Hendrikx <to...@whyscream.net>.
On 05-06-2025 18:53, Kirk Ismay wrote:
> I'm trying to find a way to reduce a certain kind of spam that uses
> sensational finance / technology subject lines. Typically Elon, Trump,
> Tesla etc. It often slips through my ruleset. I've tried to create
> local email and domain blocklists, as well as keyword rules based on the
> mailing address in the body. Everything changes too frequently to be
> able to keep up. They're using commercial email services like MailGun,
> SendGrid, or Salesforce. None of the users I talk to have subscribed to
> this sort of thing, and yet it's not all users that get this.
>
> Any suggestions would be helpful!
>
> Thanks, Kirk
>
> Here are some sample subject / senders:
>
> From: "Derek Langford | TVI" <ne...@tvi.tradevisioninsights.com>
> Subject: Holy Grail of dividend stocks
>
> From: "Cybertruck Stunt Video | 1st Market Leader"
> <di...@1ml.1marketleader.com>
> Subject: Watch Demo: Elon Musk’s New $9 Trilli
>
> From: "Trump's Loophole Exposed | Chris Archer from CCA"
> <da...@cc.cryptocurrencyadvices.com>
> Subject: Elon’s IRS Attack Just Exposed a Trum
>
> From: "Tesla Attack Exposed [Alan Brooks from SWP]"
> <ne...@take.strategicwealthpro.com>
> Subject: 🔴 Tesla Cybertruck Explosion: The Hi
>
> Subject: This Tiny AI Firm Could Be Musk’s Real Play
> From: Musk’s Hidden Play — Daniel Brown | GM He
>
> Subject: Collect Thousands Monthly Without Paying Taxes!
> From: "Social Security Check - William Carter [FMT]"
>
> From: "Musk Stepping Down - Jacob Walker @ FMP"
> <da...@financemarketprovider.com>
> Subject: Trump and Musk at Odds: Financial Chaos Could Destroy Your
> Retirement!
>
> From: Trump’s crypto explosion, Emily Howard |
> Subject: BREAKING NEWS: Trump’s crypto venture
>
> From: "\"Elon sounds the alarm, Amanda S. From RITF\""
> Subject: Elon Warns: Exec Order 14024 Targets Dollar
>
> From: "Trump's Loophole Exposed | Chris Archer from CCA"
> <da...@cc.cryptocurrencyadvices.com>
> Subject: Elon’s IRS Attack Just Exposed a Trum
>
> From: "Musk Stepping Down - Jacob Walker @ FMP"
> <da...@financemarketprovider.com>
> Subject: Trump and Musk at Odds: Financial Chaos Could Destroy Your
> Retirement!
>
> Subject: Collect Thousands Monthly Without Paying Taxes!
> From: "Social Security Check - William Carter [FMT]"
>
> Subject: This Tiny AI Firm Could Be Musk’s Real Play
> From: Musk’s Hidden Play — Daniel Brown | GM He
>
> From: "Tesla Attack Exposed [Alan Brooks from SWP]"
> <ne...@take.strategicwealthpro.com>
> Subject: 🔴 Tesla Cybertruck Explosion: The Hi
>
> From: "Derek Langford | TVI" <ne...@tvi.tradevisioninsights.com>
> Subject: Holy Grail of dividend stocks
Hi,
I see some patterns like the recurring pipe and dash characters in From
lines. But maybe you can share a few full messages with headers? Maybe
there are easier ways to whack this mole.
Kind regards,
Tom