Re: No hit on this..

[Ilan Aisic]

I'm also getting a lot of variations on this spam trying to promote some junk stock.  Every time a different name is in the subject like "Demetrius here :)"  or "Mabel here :)" and of course the "From:" is different.     RAZOR and DCC catch most of them but some slip through.

One even managed to trigger only the following rules:
    0.6 J_CHICKENPOX_44        BODY: 4alpha-pock-4alpha
    0.0 ADVANCE_FEE_1          Appears to be advance fee fraud

I intend to add the rule Phil suggested of:
header   SPAMMER_HERE        Subject =~ /here \:\)$/ 
...


--
Ilan Aisic
Registered Linux User 8124 http://counter.li.org