In the past few weeks, we've been hit hard by a new class of spam email (or at least new to me/us). I'm calling it "tabloid spam" because they send supermarket-tabloid headlines with tabloid copy, which bypasses Spam-assassin.
Here's some sample subject lines:
Mark Cuban Tells Anderson Cooper The Economy is in for a Meltdown
Looking for Walk In Bath Information? Compare These Choices.
One of the Biggest Government Lies: "The Food We Eat is Safe"
Donald Trump: I Consult Myself On Foreign Policy, "Because I Have A Very Good Brain"
The messages contain 1-2 links, but it's not clear if they are selling anything or not without clicking on the link. The messages all contain lots of body copy, some of which reads like spun web content. Spam Assassin can't tell this style copy from legitimate mail.
The frequency of these messages are increasing where we got maybe 20 per day a few weeks ago, and it's escalated to where we now get hundreds of these per day. They all come from different email addresses, and the subjects are wide and varied, but most are like supermarket tabloid headlines.
What we've tried / ideas:
The only way we can get Spam-assassin to flag these is to dial it down to a threshold of
2
which gets most of them, along with half of our legitimate mail!Someone suggested changing out email addresses. That seems like a drastic measure and a short-term one at best.
We already use rdb blacklists to reject mail on postfix. They aren't stopping this.
Add keywords to Spam Assassin and give them a score, for example, set it to add a +10 spam score to any subject line containing "Donald Trump", "Dr. Oz", "Anderson Cooper", etc. This seems labor intensive, but I will look into adding rules next, at least for temporary relief.
Aside from that, any other ideas or suggestions on how to deal with this? I'm sure we're not the only ones dealing with this new(?) type of spam email.
Our environment is Linux (Ubuntu LTS) with Postfix+Spam Assassin.