https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6594
Bug #: 6594
Summary: Similar to SARE's evilnumbers - something needed in
SA?
Product: Spamassassin
Version: unspecified
Platform: All
OS/Version: All
Status: NEW
Severity: minor
Priority: P2
Component: Rules
AssignedTo: [email protected]
ReportedBy: [email protected]
Classification: Unclassified
I'm seeing alot of spam with the following signature:
Want to be removed?
http://www.bestmove2u.com/ef0f27c87345174/c9b3c4d496fbdba7a1310/56ccca88293d342e710bcaae3630d93b/03/index.html
Or,
1804 Garnet Ave #142
Pacific Beach, CA 92109
SARE had the "evilnumbers" extension which targeted phone numbers and addresses
left by spammers, but the main SA ruleset doesn't seem to have an equivalent.
The URL varies. "Want to be removed?" (which has rule REMOVE_BEFORE_LINK et.
al.) and the address are constant. Should we (or do we even want to) create a
ruleset similar to that concept to list known spammer addresses and telephone
numbers? REMOVE_BEFORE_LINK seems insufficient.... Generic rules aren't
strong enough in this case.
PS: Most of the message was an image file to bypass text-based scanners like
SA.
This particular spammer has been using this address unchanged for a few months.
--
Configure bugmail:
https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
