> Also, Markus' optimization of checking CMDSPACE before
> SUBJECT checking will not work in two cases:
I've discovered another rare one. It seems like certain MTA's does correct
commandspaces and so a forwarded messages from one of this MTA's will pass
the filter files as it hasn't failed CMDSP
st that unless you are catching 2) elsewise, then don't try to
use the CMDSPACE short-circuit optimization.
Andrew 8)
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser
Sent: Tuesday, May 17, 2005 12:17 PM
To: Declude.JunkMail@declude.com
Subjec
: "Markus Gufler" <[EMAIL PROTECTED]>
To:
Sent: Monday, May 16, 2005 5:49 PM
Subject: RE: [Declude.JunkMail] German political spam
If someone is interested in, I've updated my sober-q filter files.
I've split the patterns in two files: SUBJECT and BODY lines. They will
n
On 16 May 2005 at 23:49, Markus Gufler wrote:
Thanks!
-Nick
> If someone is interested in, I've updated my sober-q filter files.
> I've split the patterns in two files: SUBJECT and BODY lines. They
> will not catch more but:
>
> 1.) The SUBJECT filterfile will be processed only if CMDSPACE has
>
http://www.joewein.de/sw/spam-sober-h.htm
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Dave Marchette
Sent: Sunday, May 15, 2005 00:07
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] German political spam
Anyone else getting hit with
Markus Wrote:
If someone is interested in, I've updated my sober-q filter files.
I'm interested! Thanks Markus!
Bill Green
dfn Systems
---
[This E-mail scanned for viruses by Declude Virus]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL
I cloned the subject lines and added them in this format to help combat the
bounces:
BODY 150 CONTAINS SUBJECT: (marcus's subjects)
- Original Message -
From: "Markus Gufler" <[EMAIL PROTECTED]>
To:
Sent: Sunday, May 15, 2005 11:41 AM
Subject: RE: [Declude.JunkM
Thanks,
Robert
- Original Message -
From: Sanford Whiteman <[EMAIL PROTECTED]>
To: Robert
Sent: Sunday, May 15, 2005 4:54 PM
Subject: Re[2]: [Declude.JunkMail] German political spam
> > If this message fails the test and I was to have it set to delete
> > the
> If this message fails the test and I was to have it set to delete
> the message, Would the message create a postmaster for non exsisting
> users? or just delete the message?
The only reason _any_ post-delivery DSNs would be generated is if you
specifically are choosing to use the BOUNCEONLYI
Sent: Sunday, May 15, 2005 3:00 PM
Subject: RE: [Declude.JunkMail] German political spam
>
>
> > Correct. And along those lines, two thoughts come to mind.
> >
> > 1 Many of your users may see hundreds(maybe thousands) of
> > nondeliverable\unknown user bounces. '
> Correct. And along those lines, two thoughts come to mind.
>
> 1 Many of your users may see hundreds(maybe thousands) of
> nondeliverable\unknown user bounces. 'Damage control Monday'
> should be fun this week.
Strange but at the moment I can't see only a very low number of NDR's
So
Nick wrote:
Seems to be a very sophisticated campain - of which at least 90% so
far are coming from clean domains/clean ip's. Maybe someone Matt? ,
can figure out some sort of pattern we can target from the spamware?
I could code up a quick external test in VBScript that would capture
this s
: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] German political spam
On 15 May 2005 at 10:50, Marc Catuogno wrote:
> I am seeing randomized addresses, but they seem to be from "related
> industries". We are in real-estate, the address are random then @
> other
On 15 May 2005 at 18:41, Markus Gufler wrote:
Excellent - Good job & thanks for sharing!
-Nick
> Ok, I've added all subject line patterns (my, Marc's Nicks and both
> Spamassassin cf-files) to one declude filter file.
>
> Please note that I've commented out "h eise.de" and "s piegel.de" body
>
Here's another one:
http://mailscanner.prolocation.net/german.cf
Bill
- Original Message -
From: "Markus Gufler" <[EMAIL PROTECTED]>
To:
Sent: Sunday, May 15, 2005 9:07 AM
Subject: RE: [Declude.JunkMail] German political spam
The direct link for spamassassin
On 15 May 2005 at 18:07, Markus Gufler wrote:
> The direct link for spamassassins filter file is
> http://www.filterregel.de.vu/rassistische_mails_2.cf
Thank you Markus!
-Nick
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED],
he idea behind this party: look
backwards in german story for 60-70 years. :-/
Markus
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of
Darrell ([EMAIL PROTECTED])
Sent: Sunday, May 15, 2005 4:27 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.Jun
The direct link for spamassassins filter file is
http://www.filterregel.de.vu/rassistische_mails_2.cf
Markus
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
growing. The idea behind this party: look
backwards in german story for 60-70 years. :-/
Markus
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of
> Darrell ([EMAIL PROTECTED])
> Sent: Sunday, May 15, 2005 4:27 PM
> To: Dec
"more than 15" is all you got? I've had at least 112.
G.Z.
-- Original Message --
From: "Shayne Embry" <[EMAIL PROTECTED]>
Reply-To: Declude.JunkMail@declude.com
Date: Sun, 15 May 2005 09:04:48 -0500
>Random addresses on the ones I'm getting. All from SW
On 15 May 2005 at 10:50, Marc Catuogno wrote:
> I am seeing randomized addresses, but they seem to be from "related
> industries". We are in real-estate, the address are random then @
> other real-estate companies, title companies, etc.
Good observation - all of the ones I have received have come
com
Subject: Re: [Declude.JunkMail] German political spam
What are the return/sender addresses looking like? Randomized?
Darrell
---
Check out http://www.invariantsystems.com for utilities for Declude And
Imail. IMail Queue Monitoring, Declude Overflow Queue Mo
SPAM with the default
configuration. Download a copy today - http://www.invariantsystems.com
- Original Message -
From: "Darrell ([EMAIL PROTECTED])" <[EMAIL PROTECTED]>
To:
Sent: Sunday, May 15, 2005 10:02 AM
Subject: Re: [Declude.JunkMail] German political spam
Random addresses on the ones I'm getting. All from SWBell DSL IPs. Not failing any tests other than GIBBERISH, and not even that one all the time. I'm using SmarterMail, so CMDSPACE isn't an available test for us. I've had more than 15 messages get through on my personal account alone since Saturda
AIL PROTECTED]>
To:
Sent: Sunday, May 15, 2005 3:37 AM
Subject: RE: [Declude.JunkMail] German political spam
> > Anyone else getting hit with massive waves of German spam as
> > a byproduct of modified Sober code continuing from around 2
> > pm EDT today, or am I 'unique&
, and Log Parsers.
- Original Message -
From: "Marc Catuogno" <[EMAIL PROTECTED]>
To:
Sent: Sunday, May 15, 2005 9:34 AM
Subject: RE: [Declude.JunkMail] German political spam
I've added all the phases that I have found in the e-mails that got through
to me. I don'
> Anyone else getting hit with massive waves of German spam as
> a byproduct of modified Sober code continuing from around 2
> pm EDT today, or am I 'unique' in this?
Update:
I've noted that this type of messages always will fail CMDSPACE
Please take care that the links that are part of the m
Yup, got hit with loads of 'em!
G.Z.
-- Original Message --
From: "Dave Marchette" <[EMAIL PROTECTED]>
Reply-To: Declude.JunkMail@declude.com
Date: Sat, 14 May 2005 22:07:09 -0700
>Anyone else getting hit with massive waves of German spam as a byprod
Anyone else getting hit with massive waves of German spam as a byproduct of
modified Sober code continuing from around 2 pm EDT today, or am I 'unique' in
this?
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "u
29 matches
Mail list logo
