fake ASDA spam

[David Lee]

(This might be a UK-only spam.)

Some of our users are getting lots of instances of a new spam allegedly
offering money off for shopping at ASDA.  The spam seems to have little
content for Bayes to get its teeth into reliably; the linked URLs seem to
change; the set of machines from which it arrives changes.  So although it
gets an SA spam score (DCC, RAZOR2) there is insufficient evidence for a
secure conviction, so it gets through and annoys our users.

Has anyone (probably in the UK) seen this and been able to come up with a
means (SA rules?) of detecting its characteristics, whilst avoiding false
positives?

Thanks.

-- 

:  David Lee                                I.T. Service          :
:  Senior Systems Programmer                Computer Centre       :
:  UNIX Team Leader                         Durham University     :
:                                           South Road            :
:  http://www.dur.ac.uk/t.d.lee/            Durham DH1 3LE        :
:  Phone: +44 191 334 2752                  U.K.                  :