Re: [Declude.JunkMail] German political spam

Matt Sun, 15 May 2005 09:23:43 -0700

All of the links appear to be to legitimate sites that just so happen to have stories on them that the Nazi's are interested in having people read. This happened before about a year ago.

Anyway, it just goes to show the English-centric approach that many of the blacklist maintainers use, or the general lack of appropriate procedure for qualifying such domains for being listed. Personally, I have many issues with international traffic primarily due to blacklists and these two things. SBL is one of the largest offenders, but SURBL also has an issue with qualifying domains of all sorts and they could definitely do better. The way that things stand, some spammer could probably send out a million E-mail's with your domain in it and it would likely get listed in SURBL despite you being a completely innocent party.

Matt

Markus Gufler wrote:

I don't know "l ibasoli.de" but other domains like "s piegel.de" has
absolutely nothing to do with the spammers. It's the online version of a
really big, important and excellent german magazine and it's not good to
block messages containing this domain if you don't want block also the flow
of legit information. The same for "h eise.de"


http://www.h eise.de/newsticker/meldung/59562
For example contains a short description of whats going on and also some
user comments that have posted their spamassassin and postfix filter files
for this type of spam:
http://www.h
eise.de/newsticker/foren/go.shtml?forum_id=78695&list=1&hs=0&c=7992164


On the other side there are also links like "n pd.de" and I fear this is
also the source of this spam campain. It's a german party, fortunately not
realy large but unfortunately growing. The idea behind this party: look
backwards in german story for 60-70 years.  :-/

Markus

-----Original Message-----
From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED]] On Behalf Of 
Darrell ([EMAIL PROTECTED])
Sent: Sunday, May 15, 2005 4:27 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] German political spam

Actually, looking at this again I checked yesterday's log 
files.  It seems that most of the domains were starting to be 
caught on SURBL and other URI lists around 8pm Eastern.

2005-05-14 20:02:57.171 2005-05-14 20:02:57.296 
E:\IMAIL\SPOOL\D91ACBA660122CE0A.SMD rocknord.de 127.0.0.4 on 
multi.surbl.org [4] [Total Weight=2]
2005-05-14 21:47:07.609 2005-05-14 21:47:08.828 
E:\IMAIL\SPOOL\DAA10CCE60118147C.SMD spiegel.de 127.0.0.2 on 
multi.surbl.org [2] [Total Weight=7]
2005-05-14 21:48:01.046 2005-05-14 21:48:02.328 
E:\IMAIL\SPOOL\DAA4D12BC0264FFE5.SMD npd.de 127.0.0.2 on 
multi.surbl.org [2] [Total Weight=7]
2005-05-14 21:50:54.968 2005-05-14 21:50:55.281 
E:\IMAIL\SPOOL\DAAFBBD960122AAD1.SMD rp-online.de 127.0.0.2 
on multi.surbl.org [2] [Total Weight=7]

Darrell
--------------------------------------------------------------
-----------
invURIBL - Intelligent URI Filtering.  Stops 85%+ SPAM with 
the default configuration. Download a copy today - 
http://www.invariantsystems.com


----- Original Message -----
From: "Darrell ([EMAIL PROTECTED])" 
<[EMAIL PROTECTED]>
To: <Declude.JunkMail@declude.com>
Sent: Sunday, May 15, 2005 10:02 AM
Subject: Re: [Declude.JunkMail] German political spam

Markus,

I have noticed that most of these messages at the start of

this campaign

were getting caught on SURBL using invURIBL.  Do you know

anything about

that domain listed below?

2005-05-15 00:19:19.890 2005-05-15 00:19:19.968
E:\IMAIL\SPOOL\DCDC4C1BB006E894A.SMD libasoli.de 127.0.0.2 on
multi.surbl.org [2] [Total Weight=7]

Darrell

-------------------------------------------
invURIBL - Intelligent URI Filtering.  Stops 85%+ SPAM with

the default

configuration. Download a copy today -

http://www.invariantsystems.com

----- Original Message ----- 
From: "Markus Gufler" <[EMAIL PROTECTED]>
To: <Declude.JunkMail@declude.com>
Sent: Sunday, May 15, 2005 3:37 AM
Subject: RE: [Declude.JunkMail] German political spam

Anyone else getting hit with massive waves of German spam as
a byproduct of modified Sober code continuing from around 2
pm EDT today, or am I 'unique' in this?

Update:
I've noted that this type of messages always will fail CMDSPACE

Please take care that the links that are part of the

message body does
not

have to do anything with the initiator(s) of this messages.

For example
www.heise.de is an important german computer magazine and

always strive

for

announcing security risk, spam tecniques and so on.
www.spiegel.de is a big german magazine and I'm 100% sure

that it has

nothing to do with this type of spam.

Largely blocking this URI's in Blacklists maybe it's

exactly what this

spammers want.

Markus

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

-- 
=====================================================
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=====================================================

Re: [Declude.JunkMail] German political spam

Reply via email to