The German Spam

[Randal, Phil]

Attached are two spamassassin .cf files which will get them (and the
bounces).

And this will catch the originals too:

header __SOBER_P_MSGID Message-ID =~ /<[0-9a-f\.]{15,22}\@/
header __SOBER_P_CTYPE Content-Type =~
/text\/plain.*charset=\"us-ascii\"/
header __SOBER_P_PRIO X-Priority =~ /^3 /
header __SOBER_P_IMP Importance =~ /^Normal/

meta SOBER_P_SPAM (__SOBER_P_MSGID && __SOBER_P_CTYPE && __SOBER_P_PRIO
&& __SOBER_P_IMP )
score SOBER_P_SPAM 18.0
describe SOBER_P_SPAM Rassistische Mail Sober-P

Cheers,

Phil

----
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK

> -----Original Message-----
> From: MailScanner mailing list
> [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Billy A. Pumphrey
> Sent: 19 May 2005 17:28
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: The German Spam
>
> I don't think that I missed any German spam converstations.
> I did turn on MCP to try and help it get them.
>
> What is everyone doing to try and get the German Spam?  My
> server looks like it is getting a nice bit of them, but users
> are still getting them.
> A user reported about 10 a week.
>
> ------------------------ MailScanner list
> ------------------------ To unsubscribe, email
> jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the Wiki (http://wiki.mailscanner.info/)
> and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2, Application/OCTET-STREAM (Name: "german.cf")  6.5KB. ]
    [ Unable to print this part. ]


    [ Part 3, Application/OCTET-STREAM (Name: "german_bounce.cf")  7.6KB. ]
    [ Unable to print this part. ]