On Sun, Sep 01, 2019 at 11:58:10PM -0700, Loren Wilton wrote: > About once a week or so I get a notice from "Advanced Computer System > Repair" notifying me that my subscription (that I don't have) is about to > expire, and I need to download their latest piece of malware to keep my > subscription active. > > This is a scam that has been around since at least 2017, judging from a > quick web search. > > I'm surprised that there isn't an SA rule (other than the one I just added > locally) that checks for this and awards it a few points.
If there are no SA rules for something, it probably means no SA mass-checker has seen such spam, or no one has reported it to be added so far. You could simply be one of the few that is actually receiving it. If it's rare spam, it makes no difference if it's added to SA rules - it won't even be scored if no mass-checker has such spam in corpus. One would imagine it hitting URIBL's, ClamAV/Sanesecurity etc, but hard to say without seeing it.
