Wish: multi-part rule to block phony YouTube spam/phishing messages

SpamSieve
1

For several weeks, I’ve been receiving phony messages that appear to be from a YouTube user:

  • From: random name & email address
  • To: one of my many email accounts
  • Subject: [first & last name] sent you a message
  • message: official looking HTML message with a YouTube logo + generic avatar + “[name] has sent you a message:” + generic quick message w/ a link + footer with “Help” and other links

I know the messages are bogus because all links are to a suspicious URL – same URL for all links in a single message, different URLs in different messages.

These message are now arriving once or twice a day. I mark each one as Junk, but SpamSieve has not learned to recognize these annoying messages.

I’d like to add a rule to the Blocklist, but it appears rules are a single comparison action. I can’t come up with a text comparison that would block these bogus message without catching some legitimate messages.

In Apple Mail rules, I’d create a multi-part “And” rule that matched the end of the subject line + several stock phrases in the message body.

If there’s no way to do this in SpamSieve, I’d like to add “Multi-part Rules” to the Wish List.

– Ward

2

Please send a report via e-mail.

You can still use an Apple Mail rules to block particular messages. Just make sure it’s above the “SpamSieve” rule in the list.

3

Thanks for sending the log file and other info. I think SpamSieve will eventually learn to catch these spams if you keep training it. However, I will be making some changes in a future version of SpamSieve so that it is better able to recognize them.

4

I’ve made some improvements in SpamSieve 2.9.6 so that it’s better able to catch these spam messages.