I don't know "l ibasoli.de" but other domains like "s piegel.de" has absolutely nothing to do with the spammers. It's the online version of a really big, important and excellent german magazine and it's not good to block messages containing this domain if you don't want block also the flow of legit information. The same for "h eise.de"
http://www.h eise.de/newsticker/meldung/59562 For example contains a short description of whats going on and also some user comments that have posted their spamassassin and postfix filter files for this type of spam: http://www.h eise.de/newsticker/foren/go.shtml?forum_id=78695&list=1&hs=0&c=7992164 On the other side there are also links like "n pd.de" and I fear this is also the source of this spam campain. It's a german party, fortunately not realy large but unfortunately growing. The idea behind this party: look backwards in german story for 60-70 years. :-/ Markus > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of > Darrell ([EMAIL PROTECTED]) > Sent: Sunday, May 15, 2005 4:27 PM > To: [email protected] > Subject: Re: [Declude.JunkMail] German political spam > > Actually, looking at this again I checked yesterday's log > files. It seems that most of the domains were starting to be > caught on SURBL and other URI lists around 8pm Eastern. > > 2005-05-14 20:02:57.171 2005-05-14 20:02:57.296 > E:\IMAIL\SPOOL\D91ACBA660122CE0A.SMD rocknord.de 127.0.0.4 on > multi.surbl.org [4] [Total Weight=2] > 2005-05-14 21:47:07.609 2005-05-14 21:47:08.828 > E:\IMAIL\SPOOL\DAA10CCE60118147C.SMD spiegel.de 127.0.0.2 on > multi.surbl.org [2] [Total Weight=7] > 2005-05-14 21:48:01.046 2005-05-14 21:48:02.328 > E:\IMAIL\SPOOL\DAA4D12BC0264FFE5.SMD npd.de 127.0.0.2 on > multi.surbl.org [2] [Total Weight=7] > 2005-05-14 21:50:54.968 2005-05-14 21:50:55.281 > E:\IMAIL\SPOOL\DAAFBBD960122AAD1.SMD rp-online.de 127.0.0.2 > on multi.surbl.org [2] [Total Weight=7] > > Darrell > -------------------------------------------------------------- > ----------- > invURIBL - Intelligent URI Filtering. Stops 85%+ SPAM with > the default configuration. Download a copy today - > http://www.invariantsystems.com > > > ----- Original Message ----- > From: "Darrell ([EMAIL PROTECTED])" > <[EMAIL PROTECTED]> > To: <[email protected]> > Sent: Sunday, May 15, 2005 10:02 AM > Subject: Re: [Declude.JunkMail] German political spam > > > > Markus, > > > > I have noticed that most of these messages at the start of > this campaign > > were getting caught on SURBL using invURIBL. Do you know > anything about > > that domain listed below? > > > > 2005-05-15 00:19:19.890 2005-05-15 00:19:19.968 > > E:\IMAIL\SPOOL\DCDC4C1BB006E894A.SMD libasoli.de 127.0.0.2 on > > multi.surbl.org [2] [Total Weight=7] > > > > Darrell > > > > ------------------------------------------- > > invURIBL - Intelligent URI Filtering. Stops 85%+ SPAM with > the default > > configuration. Download a copy today - > http://www.invariantsystems.com > > > > > > ----- Original Message ----- > > From: "Markus Gufler" <[EMAIL PROTECTED]> > > To: <[email protected]> > > Sent: Sunday, May 15, 2005 3:37 AM > > Subject: RE: [Declude.JunkMail] German political spam > > > > > > > > Anyone else getting hit with massive waves of German spam as > > > > a byproduct of modified Sober code continuing from around 2 > > > > pm EDT today, or am I 'unique' in this? > > > > > > Update: > > > I've noted that this type of messages always will fail CMDSPACE > > > > > > Please take care that the links that are part of the > message body does > not > > > have to do anything with the initiator(s) of this messages. > > > > > > For example > > > www.heise.de is an important german computer magazine and > always strive > > for > > > announcing security risk, spam tecniques and so on. > > > www.spiegel.de is a big german magazine and I'm 100% sure > that it has > > > nothing to do with this type of spam. > > > > > > Largely blocking this URI's in Blacklists maybe it's > exactly what this > > > spammers want. > > > > > > Markus > > > > > > --- > > > This E-mail came from the Declude.JunkMail mailing list. To > > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > > type "unsubscribe Declude.JunkMail". The archives can be found > > > at http://www.mail-archive.com. > > > > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
