Craig found that qmail sends using only numeric messageids, but the spammers
were using mixed alpha-numeric.

> -----Original Message-----
> From: Nick Rout [mailto:nick@rout.co.nz]
> Sent: Monday, June 14, 2004 11:08 AM
> To: adsl@lists.unixathome.org
> Subject: Re: Increasing spam from NZ ADSL hosts
>
> for the ignorant (Read me) what does that do?
>
> to my untutored eye it labels as germanspam anything with
> qmail@ in the
> messageid.
>
> is that a legitimate call? ie can that never be legitimate to have
> qmail@ in your messageid?
>
>
>
> On Mon, 14 Jun 2004 09:53:17 +1200
> "Craig Whitmore" <lennon@orcon.net.nz> wrote:
>
> > Yes. It was me :-)
> >
> > header GERMANSPAM MESSAGEID =~ /^<.*[a-z].*\.qmail\@.*>/
> > describe GERMANSPAM Contains German Spam
> > score GERMANSPAM 20 20 20 20
> >
> > Works 100%
> >
> > Thanks
> > Craig
> >
> >
> > > -----Original Message-----
> > > From: owner-adsl@unixathome.org
> [mailto:owner-adsl@unixathome.org] On
> > > Behalf Of Mike Cooper
> > > Sent: Monday, June 14, 2004 9:18 AM
> > > To: Craig Humphrey
> > > Cc: 'adsl@lists.unixathome.org'
> > > Subject: Re: Increasing spam from NZ ADSL hosts
> > >
> > > Yeah, theres been heaps in the news about it - have a
> look at some of
> > > the IT news sites:
> > >
> http://computerworld.co.nz/news.nsf/UNID/C0F6690249C852D2CC256
> EB0000B4F84
> > > http://www.theregister.co.uk/2004/06/11/german_hate_mail_virus/
> > >
> > > I think someone from this list developed a spamassasin
> rule that is
> > > picking them up.
> > >
> > > Craig Humphrey wrote:
> > >
> > > >Hi People,
> > > >
> > > >Has anyone else noticed the increasing volume of German
> Spam from NZ ADSL
> > > >hosts?
> > > >I've had dozens over the last week, all from ADSL IP's.
> So far from
> > > Xtra,
> > > >IHUG and Paradise.
> > > >
> > > >What do people think, exploit based spam relaying or
> have professional
> > > >spammers come to NZ?
> > > >
> > > >Note: these are beating my spam blocker, since it
> doesn't understand
> > > German.
> > > >
> > > >Later'ish
> > > >Craig
> > > >
> > > >
> > > --
> > > This message is part of the NZ ADSL mailing list.
> > > see http://unixathome.org/adsl/ for archives, FAQ,
> > > and various documents.
> > > To unsubscribe: send mail to majordomo@lists.unixathome.org
> > > with "unsubscribe adsl" in the body of the message
> > >
> >
> >
> > --
> > This message is part of the NZ ADSL mailing list.
> > see http://unixathome.org/adsl/ for archives, FAQ,
> > and various documents.
> > To unsubscribe: send mail to majordomo@lists.unixathome.org
> > with "unsubscribe adsl" in the body of the message
> >
>
>
> --
> This message is part of the NZ ADSL mailing list.
> see http://unixathome.org/adsl/ for archives, FAQ,
> and various documents.
> To unsubscribe: send mail to majordomo@lists.unixathome.org
> with "unsubscribe adsl" in the body of the message
>
>

-- 
This message is part of the NZ ADSL mailing list. 
see http://unixathome.org/adsl/ for archives, FAQ, 
and various documents. 
To unsubscribe: send mail to majordomo@lists.unixathome.org 
with "unsubscribe adsl" in the body of the message