RE: [Declude.JunkMail] COMBO-Filter solution for todays german polite emails

[Markus Gufler]

We are Italian, based in the north of Italy, .it domain, but german speaking and most german customers. So I wasn't sure if there is some "intelligent" delivery to german recipients.   BTW: This messages comes from sober.G infected systems.   Markus         From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bonno Bloksma Sent: Thursday, June 10, 2004 3:15 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] COMBO-Filter solution for todays german polite emails Hi,   We are Dutch, based in the Netherlands and we have a .nl domain name. So it's at least more then just .de domains that get spammed. It looks like these mails are news reports which are sent to various addresses. Groetjes,   Bonno Bloksma ----- Original Message ----- From: Markus Gufler To: [EMAIL PROTECTED] Sent: Thursday, June 10, 2004 2:23 PM Subject: RE: [Declude.JunkMail] COMBO-Filter solution for todays german polite emails Same here.   I've updated and simplyfied the initialy posted filters several times in the last hours. For best results please download the newest filter files from http://www.zcom.it/decludeupdater/polit_filter.zip   I'm interested if this wave of spam mails is a global phenomenon, or if they are able to restrict delivery to recipientsof a certain language/country. Any info's?   Markus     From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bonno Bloksma Sent: Thursday, June 10, 2004 1:51 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] COMBO-Filter solution for todays german polite emails Hi,   Spammers are getting smart. This spam did not fail any of the test we have in place using (near) default Declude tests. It scored 0 points. Groetjes,   Bonno Bloksma ----- Original Message ----- From: Markus Gufler To: [EMAIL PROTECTED] Sent: Thursday, June 10, 2004 9:15 AM Subject: [Declude.JunkMail] COMBO-Filter solution for todays german polite emails Hi all,   Maybe interesting for german/european email admins:   Some hours ago someone/something has started to send german messages trough the internet containing politic statements.   At the first moment it seems very difficult to filter out this type of messages comming from different IPs   But with the following COMBO filters I can see excellent results   POLIT-CONTENT filter C:\IMail\Declude\lists\filter_polit_content.txt   x 0 0 # contains different tipical body keywords # in any case 0 points POLIT-QMAIL filter C:\IMail\Declude\lists\filter_polit_qmail.txt   x 0 0 # all this messages contains ".qmail@" in the header (message-id part) # in any case 0 points POLIT-UMLAUT filter C:\IMail\Declude\lists\filter_polit_umlaut.txt   x 0 0 # All messages doesn't contain any german "umlaut" and special characters (�, �, �, �) # in any case 0 points # should avoid false positives POLIT-COMBO filter C:\IMail\Declude\lists\filter_polit_COMBO.txt   x 0 0 # The logic behind this filter: # skip if no POLIT-CONTENT body keyword and no POLIT-QMAIL header string was found # skip if any special german character (POLIT-UMLAUT) was found # Add 100 points if HELOBOGUS has failed (all this messages has a random generated helo string)     Filter-files can be downloaded from http://www.zcom.it/decludeupdater/polit_filter.zip     Markus