"unlearnable" spam

[David Siroky <ml...@dasir.net>]

Hi!

I'm dealing last days with a very strange spam. It is about stocks. It
always contains a 4-letter company mark, some price estimations and the
sender always starts with "debora". The text for each company is not
changing but if I put those mails through sa-learn it makes no
difference. Each mail earns only 4-6 points max. My SA is 3.1.4, Debian
testing. Any advices?

Thank you.

David

Re: "unlearnable" spam

[Martin Hepworth <ma...@solidstatelogic.com>]

David Siroky wrote:
> Hi!
> 
> I'm dealing last days with a very strange spam. It is about stocks. It
> always contains a 4-letter company mark, some price estimations and the
> sender always starts with "debora". The text for each company is not
> changing but if I put those mails through sa-learn it makes no
> difference. Each mail earns only 4-6 points max. My SA is 3.1.4, Debian
> testing. Any advices?
> 
> Thank you.
> 
> David
> 
> 
> 
Look at the SARE stocks ruleset from www.rulesemporium.com, this (and 
the other SARE rules) are very useful at catching this stuff...

-- 
Martin Hepworth
Senior Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.	

**********************************************************************

Re: "unlearnable" spam

[John Rudd <jr...@ucsc.edu>]

David Siroky wrote:
> Hi!
> 
> I'm dealing last days with a very strange spam. It is about stocks. It
> always contains a 4-letter company mark, some price estimations and the
> sender always starts with "debora". The text for each company is not
> changing but if I put those mails through sa-learn it makes no
> difference. Each mail earns only 4-6 points max. My SA is 3.1.4, Debian
> testing. Any advices?
> 
> 

So far, for me, RelayChecker has caught every one of the "debora" messages.

Check the mailing list archives, I just made another release of 
RelayChecker a day or two ago.