Broadband Tech > Security > Security > Heads-up: Sober Spam wave started last night

reply to kpatz

POSTFIX filter for sober spam

quote:

---

One of our readers, Eric provided a postfix regex file that can be used to filter these german spams. Thanks for this Eric.

Typically this is enabled through the main.cf file of postfix:

header_checks = regexp:/usr/local/etc/postfix/headfilt.regex

----- headfilt.regex file contents -------
/^Subject:.*Augen auf/ HOLD
/^Subject:.*Auslaenderpolitik/ HOLD
/^Subject:.*Blutige Selbstjustiz/ HOLD
/^Subject:.*Deutsche Buerger/ HOLD
/^Subject:.*Deutsche werden kuenftig beim/ HOLD
/^Subject:.*Dresden Bombing Is To Be Regretted Enormously/ HOLD
/^Subject:.*Du wirst zum Sklaven gemacht/ HOLD
/^Subject:.*Gegen das Vergessen/ HOLD
/^Subject:.*Graeberschaendung auf bundesdeutsche/ HOLD
/^Subject:.*Jahre Befreiung/ HOLD
/^Subject:.*Multi\-Kulturell/ HOLD
/^Subject:.*Paranoider Deutschenmoerder kommt/ HOLD
/^Subject:.*Polizei schlaegt Alarm/ HOLD
/^Subject:.*Transparenz ist das Mindeste/ HOLD
/^Subject:.*Tuerkei in die/ HOLD
/^Subject:.*Volk wird nur zum zahlen/ HOLD
/^Subject:.*Vorbildliche Aktion/ HOLD
/^Subject:.*Whore Lived Like a German/ HOLD
/^Subject:.*wirst ausspioniert/ HOLD
---- end of file contents ------

---

that would be better if it was complete, but looking at mine, I already see half a dozen other subjects as well as these

Here's a longer list:

/^Subject:.*Armenian Genocide Plagues Ankara/ HOLD
/^Subject:.*Augen auf/ HOLD
/^Subject:.*Auslaender bevorzugt/ HOLD
/^Subject:.*Auslaenderpolitik/ HOLD
/^Subject:.*Blutige Selbstjustiz/ HOLD
/^Subject:.*Deutsche Buerger/ HOLD
/^Subject:.*Deutsche werden kuenftig beim/ HOLD
/^Subject:.*Dresden 1945 / HOLD
/^Subject:.*Dresden Bombing Is To Be Regretted Enormously/ HOLD
/^Subject:.*Du wirst ausspioniert/ HOLD
/^Subject:.*Du wirst zum Sklaven gemacht/ HOLD
/^Subject:.*Gegen das Vergessen/ HOLD
/^Subject:.*Graeberschaendung auf bundesdeutsche/ HOLD
/^Subject:.*Hier sind wir Lehrer die einzigen Auslaender/ HOLD
/^Subject:.*Jahre Befreiung/ HOLD
/^Subject:.*Massenhafter Steuerbetrug durch auslaendische/ HOLD
/^Subject:.*Multi\-Kulturell/ HOLD
/^Subject:.*Osteuropaeer durch Fischer-Volmer Erlass/ HOLD
/^Subject:.*Paranoider Deutschenmoerder kommt/ HOLD
/^Subject:.*Polizei schlaegt Alarm/ HOLD
/^Subject:.*Schily ueber Deutschland/ HOLD
/^Subject:.*Transparenz ist das Mindeste/ HOLD
/^Subject:.*Trotz Stellenabbau/ HOLD
/^Subject:.*Tuerkei in die/ HOLD
/^Subject:.*Turkish Tabloid Enrages Germany with Nazi Comparisons/ HOLD
/^Subject:.*Verbrechen der deutschen Frau/ HOLD
/^Subject:.*Volk wird nur zum zahlen/ HOLD
/^Subject:.*Vorbildliche Aktion/ HOLD
/^Subject:.*Whore Lived Like a German/ HOLD

Is that pretty much the canonical list of ALL subject lines this thing is spewing?

Anyone have spamass rules cooked up for this yet?

edit: Found this: »mailscanner.prolocation.net/german.cf

I'm not sure I agree with the "8" score, but I may tone it down and give it a shot. Still reading the SA archives from yesterday...

It's the canonical list of sober.q-looking subjects that have hit my external mail relays (10,000 users) since about 9 PM EST last night.

1 addition to that list (English subject threw me off):

/^Subject:.*Can you believe this still happens today/ HOLD

reply to sporkme
FWIW, since midnight we've had 2,695 messages blocked. But not all of our customers get the filtering, so that number may be a bit on the low side.

reply to Eric2005
I am still getting 4-5 an hour.

My gmail account (after 50 or so mails of me reporting it as spam), has now started sending it to the spam folder. I just added those subject, so it goes staright to trash.

But, the thing is, if I look at the email, it isnt actually sent to me.

It appears that the worm, sends it to some Gmail accounts that have email fowarding set up. And unfortunetly, I am on that list.

Thank you again...SOOO much. This was bugging me for the past 3 days.