At 23:09 10/06/2004, Craig Whitmore wrote:
For those who use SpamAssassin, the 1000's of German Spams can be found easily. I just made up a rule (with help from #nzadsl people)
The Message ID's that qmail use are numbers only (checked from qmail sources (newfield.c:37+) and the spam's don't conform to this, so....
header GERMANSPAM MESSAGEID =~ /^<.*[a-z].*\.qmail\@.*>/ describe GERMANSPAM Contains German Spam score GERMANSPAM 10 10 10 10
For those who use other Anti-Spam systems, adding this rule should be easy.
Thanks Craig, Works great. By the way, has anyone noticed that these particular spams via zombie machines seem to obtain email addresses for the fake Return address in the same manner as viruses ? All spams forge the Return address of course, but this seems to be the first time I've noticed that the email addresses used for the fake Return addresses are being retrieved from the zombie machine itself, rather than the zombie just passing on the message to be sent verbatim. That means these spams are causing just as much confusion from their bounces as virus originated bounces... *sigh* Regards, Simon