Greetings all,
I keep getting spammed by someone with plain text spam that looks like investor reports. I can't find any sort of URL or phone number that would allow the spammer to gain from it tho, unless they are paid by the business being talked about. I am including the latest one(and headers from others), and was wondering if any of you had some ideas. Obviously the from address
This is what makes pump&dump spam difficult.
The benefit to the spammer is usually that they were paid by some crooked stock traders - particularly those who are in a position to make money not only on the changing price of the penny stock, but also on commissions for making those trades.
The spammer also has inside info on when the pump will start and stop so that they can get in on the trading action and make a lot of money.
The spam itself can be made to look identical to legitimate postings for stock information and doesn't usually share any reference to the original spammer - unless they are silly enough to try and brand their "stock news service".
We generally create compound rules in the core Message Sniffer rule base for these based on components from the subjects, form of the message, and the stock itself.
There is a new batch coming out right now along with the rest of a particularly bad spam storm. We have seen a dramatic (25% ++) increase in the number of new rules generated over the past few days:
http://www.sortmonster.com/MessageSniffer/Performance/ChangeRates.jsp
If you are not using a third party filter w/ Message Sniffer (such as Declude or mxGuard) then you can probably get away with coding IMail body rules for the stock code and the trading reference. Be sure to also whitelist any legitimate stock trading services that your customers may use as these simpler rules are a very blunt instrument.
Hope this helps, _M
Pete McNeil (Madscientist) Presidnet, MicroNeil Research Corporation Chief SortMonster (www.sortmonster.com)
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
