Re: What to do against newest spam flood (in germany)

Tue, 17 May 2005 05:50:22 -0700 

Oskar Eyb wrote:

today / yesterday a worm (Sober.Q) distributes a spam flood of nazi
propaganda and so on.

I'm impressed of the simplicity how this can be fight against in postfix
- with header-checks, as Ralf Hildebrand postet[1]:

/^Subject: 4,8 Mill\. Osteuropaeer durch Fischer-Volmer Erlass/
REJECT Nazi Spam 15.05.2005 RHI
/^Subject: Auf Streife durch den Berliner Wedding/ REJECT Nazi
Spam 15.05.2005 RHI
[...]



How can this be solved in qmail(-ldap) easily?
I want avoid learn postfix, but in some situations I would be happy
running postfix instead of qmail.

I hope, I'm wrong ;-)



Oskar


[1]
http://www.heise.de/newsticker/foren/go.shtml?read=1&msg_id=7992046&forum_id=78695



if u are using spamassassin, i found a ruleset for blocking spams specifically that of the sober (german) spam

here's it is, this is taken from SARE ninjas (http://www.rulesemporium.com/forums/showthread.php?s=&postid=544#post544)

file: nazi.cf
-----
#
# Nazi NDR Spam Ruleset
#
# Adjust scoring to whatever value you seem is appropriate # and works with your general settings.
#
# put file to /etc/mail/spamassassin/local.cf # # run "spamassassin --lint" and check config!
# run "spamassassin --lint -D" and check config!
#
# restart spamd, check logfiles
#
# guide for writing your own rules: http://wiki.apache.org/spamassassin/WritingRules
# guide for SA rules: http://mywebpages.comcast.net/mkett...rules-howto.txt
# regex: http://www.anaesthetist.com/mnm/perl/regex.htm
#
# tested with Spamassassin 3.0.2
#
# written by Martin Hotze
# May 16th, 2005, Version 1.0
# modified by John Dickson for NDR reports, May 17th
#
#
header __NDR_SYSTEMADM From =~ /\b System Administrator\b/
header __NDR_UNDELIVERABLE Subject =~ /\b Undeliverable\b/
body __NDR_LOCAL_NAZI01 /\bTransparenz ist das Mindeste\b/
body __NDR_LOCAL_NAZI02 /\bGegen das Vergessen\b/
body __NDR_LOCAL_NAZI03 /\bTrotz Stellenabbau\b/
body __NDR_LOCAL_NAZI04 /\b60 Jahre Befreiung\: Wer feiert\b/
body __NDR_LOCAL_NAZI05 /\bMulti\-Kulturell \= Multi\-Kriminell\b/
body __NDR_LOCAL_NAZI06 /\bAugen auf\b/
body __NDR_LOCAL_NAZI07 /\bBlutige Selbstjustiz\b/
body __NDR_LOCAL_NAZI08 /\bMassenhafter Steuerbetrug durch auslaendische Arbeitnehmer\b/
body __NDR_LOCAL_NAZI09 /\bVolk wird nur zum zahlen gebraucht\!\b/
body __NDR_LOCAL_NAZI10 /\bParanoider Deutschenmoerder kommt in Psychiatrie\b/
body __NDR_LOCAL_NAZI11 /\bAuslaender bevorzugt\b/
body __NDR_LOCAL_NAZI12 /\bDu wirst zum Sklaven\b/
body __NDR_LOCAL_NAZI13 /\bTuerkei in die EU\b/
body __NDR_LOCAL_NAZI14 /\bVerbrechen der deutschen Frau\b/
body __NDR_LOCAL_NAZI15 /\bDeutsche werden kuenftig beim Arzt abgezockt\b/
body __NDR_LOCAL_NAZI16 /\bSchily ueber Deutschland\b/
body __NDR_LOCAL_NAZI17 /\bDeutsche Buerger trauen sich nicht\b/
body __NDR_LOCAL_NAZI18 /\bDu wirst ausspioniert\b/
body __NDR_LOCAL_NAZI19 /\bOsteuropaeer durch Fischer\-Volmer Erlass\b/
body __NDR_LOCAL_NAZI20 /\bGraeberschaendung auf bundesdeutsche Anordnung\b/
body __NDR_LOCAL_NAZI21 /\bDresden 1945\b/
body __NDR_LOCAL_NAZI22 /\bPolizei schlaegt Alarm\b/
body __NDR_LOCAL_NAZI23 /\bAuf Streife durch den Berliner Wedding\b/
body __NDR_LOCAL_NAZI24 /\bHier sind wir Lehrer die einzigen Auslaender\b/
body __NDR_LOCAL_NAZI25 /\bVorbildliche Aktion\b/
body __NDR_LOCAL_NAZI26 /\bThe Whore Lived Like a German\b/
body __NDR_LOCAL_NAZI27 /\bDresden Bombing Is To Be Regretted Enormously\b/
body __NDR_LOCAL_NAZI28 /\bS\.O\.S\. Kiez\! Polizei schlaegt Alarm\b/ body __NDR_LOCAL_NAZI29 /\bArmenian Genocide Plagues Ankara 90 Years On\b/
body __NDR_LOCAL_NAZI30 /\bDeutsche Buerger trauen sich nicht \.\.\.\b/
meta LOCAL_NDR_NAZI_1 ((__NDR_SYSTEMADM && __NDR_UNDELIVERABLE && __NDR_LOCAL_NAZI01) + (__NDR_SYSTEMADM && __NDR_UNDELIVERABLE && __NDR_LOCAL_NAZI02) + (__NDR_SYSTEMADM && __NDR_UNDELIVERABLE && __NDR_LOCAL_NAZI03) + (__NDR_SYSTEMADM && __NDR_UNDELIVERABLE && __NDR_LOCAL_NAZI04) + (__NDR_SYSTEMADM && __NDR_UNDELIVERABLE && __NDR_LOCAL_NAZI05) + (__NDR_SYSTEMADM && __NDR_UNDELIVERABLE && __NDR_LOCAL_NAZI06))
meta LOCAL_NDR_NAZI_2 ((__NDR_SYSTEMADM && __NDR_UNDELIVERABLE && __NDR_LOCAL_NAZI07) + (__NDR_SYSTEMADM && __NDR_UNDELIVERABLE && __NDR_LOCAL_NAZI08) + (__NDR_SYSTEMADM && __NDR_UNDELIVERABLE && __NDR_LOCAL_NAZI09) + (__NDR_SYSTEMADM && __NDR_UNDELIVERABLE && __NDR_LOCAL_NAZI10) + (__NDR_SYSTEMADM && __NDR_UNDELIVERABLE && __NDR_LOCAL_NAZI11) + (__NDR_SYSTEMADM && __NDR_UNDELIVERABLE && __NDR_LOCAL_NAZI12))
meta LOCAL_NDR_NAZI_3 ((__NDR_SYSTEMADM && __NDR_UNDELIVERABLE && __NDR_LOCAL_NAZI13) + (__NDR_SYSTEMADM && __NDR_UNDELIVERABLE && __NDR_LOCAL_NAZI14) + (__NDR_SYSTEMADM && __NDR_UNDELIVERABLE && __NDR_LOCAL_NAZI15) + (__NDR_SYSTEMADM && __NDR_UNDELIVERABLE && __NDR_LOCAL_NAZI16) + (__NDR_SYSTEMADM && __NDR_UNDELIVERABLE && __NDR_LOCAL_NAZI17) + (__NDR_SYSTEMADM && __NDR_UNDELIVERABLE && __NDR_LOCAL_NAZI18))
meta LOCAL_NDR_NAZI_4 ((__NDR_SYSTEMADM && __NDR_UNDELIVERABLE && __NDR_LOCAL_NAZI19) + (__NDR_SYSTEMADM && __NDR_UNDELIVERABLE && __NDR_LOCAL_NAZI20) + (__NDR_SYSTEMADM && __NDR_UNDELIVERABLE && __NDR_LOCAL_NAZI21) + (__NDR_SYSTEMADM && __NDR_UNDELIVERABLE && __NDR_LOCAL_NAZI22) + (__NDR_SYSTEMADM && __NDR_UNDELIVERABLE && __NDR_LOCAL_NAZI23) + (__NDR_SYSTEMADM && __NDR_UNDELIVERABLE && __NDR_LOCAL_NAZI24))
meta LOCAL_NDR_NAZI_5 ((__NDR_SYSTEMADM && __NDR_UNDELIVERABLE && __NDR_LOCAL_NAZI25) + (__NDR_SYSTEMADM && __NDR_UNDELIVERABLE && __NDR_LOCAL_NAZI26) + (__NDR_SYSTEMADM && __NDR_UNDELIVERABLE && __NDR_LOCAL_NAZI27) + (__NDR_SYSTEMADM && __NDR_UNDELIVERABLE && __NDR_LOCAL_NAZI28) + (__NDR_SYSTEMADM && __NDR_UNDELIVERABLE && __NDR_LOCAL_NAZI29) + (__NDR_SYSTEMADM && __NDR_UNDELIVERABLE && __NDR_LOCAL_NAZI30))
score LOCAL_NDR_NAZI_1 20.000
score LOCAL_NDR_NAZI_2 20.000
score LOCAL_NDR_NAZI_3 20.000
score LOCAL_NDR_NAZI_4 20.000
score LOCAL_NDR_NAZI_5 20.000
---

Reply via email to