Hi,
I'm using SA 2.6x with SURBL and alot of SARE rules. Recently alot of stock spams are getting through.
I can't find any rule to catch this spam. Can anyone please give me a hint what rules to use?
X-Spam-Status: No, hits=4.9 required=5.0 tests=HTML_MESSAGE,
RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_DYNABLOCK,RCVD_IN_SORBS autolearn=no
version=2.63
First, a word of warning.. 2.63 is subject to DoS if a carefully made malformed message comes in. Not a huge security risk, but I'd at least consider upgrading to 2.64 or higher in the near future. (2.64 should be an easy upgrade from 2.63.. 3.0.x might be a bit more involved, but might be useful in the longer term.)
As for the spam, you might try some of these. Keep the scores low as these could cause problems for financial newsletters. However, in your case it looks like these are getting close to 5.0 on their own, so a heavy score isn't needed.
body OTCBB /\bOTCBB\b/ score OTCBB 0.4 describe OTCBB mentions penny stocks
body OTCBB2 /\bOver the Counter bulletin board\b/i score OTCBB2 0.4 describe OTCBB2 mentions penny stocks
body PINK_SHEET /\bPink Sheet (?:Stocks?|trading)\b/i score PINK_SHEET 0.4 describe PINK_SHEET mentions penny stocks.
body INVEST_ADVICE /\bInvestment Advice\b/i score INVEST_ADVICE 0.2 describe INVEST_ADVICE offers investment advice.
Note: i just wrote these, and have not tested or linted them. PINK_SHEET might have some logic errors, but I think it's ok.
