[Mimedefang] German Hate Spam

[Bill Randle]

As you might guess, this has been discussed recently on
the SpamAssassin list. It appears the simplest rule is a
header check (which could also be done in the MTA):

header  GERMANSPAM  MESSAGEID =~ /^<.*[a-z].*\.qmail\@.*>/
describe        GERMANSPAM Contains German Spam
score           GERMANSPAM 20

You can add this to your local.cf file.

Valid qmail message ids do not contain lowercase letters.
There are also rules that match the various subjects, but
the subject line is changing as the email is propagated via
a virus/worm.

    -Bill


Chris Masters wrote:

>Hi All,
>
>We were hit by this today [in the UK]:
>
>http://www.theregister.co.uk/2004/06/11/german_hate_mail_virus/
>
>We're thinking that the best approach is to write a
>SpamAssassin rule.
>
>Any other ideas?
>
>Thanks, Chris
>
>
>	
>		
>__________________________________
>Do you Yahoo!?
>Friends.  Fun.  Try the all-new Yahoo! Messenger.
>http://messenger.yahoo.com/ 
>_______________________________________________
>Visit http://www.mimedefang.org and http://www.canit.ca
>MIMEDefang mailing list
>MIMEDefang at lists.roaringpenguin.com
>http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
>  
>