Re: [Security-Discuss] Postfix filter for Sober.Q AKA german spam emails

This might be a losing battle, but here's a few more:

/^Subject: .*Graeberschaendung auf bundesdeutsche Anordnung.*/ DISCARD SoberQ Spam
/^Subject: .*Massenhafter Steuerbetrug durch auslaendische Arbeitnehmer.*/
DISCARD SoberQ Spam
/^Subject: .*Schily ueber Deutschland.*/ DISCARD SoberQ Spam



---------- Original Message -----------
From: "Jordan T." <mandrake-discuss-c1zCYYqwkzUxGtLu5B1ANRCuuivNXqWP@public.gmane.org>
To: security-discuss-4qZELD6FgxheH41UXmfQsti2O/[email protected]
Sent: Tue, 17 May 2005 16:59:12 +0800
Subject: [Security-Discuss] Postfix filter for Sober.Q AKA german spam emails

> I got pretty annoyed with the new Sober variant (Q) sending german 
> spam emails to our system all day so I've written a postfix filter. 
> Simply put "header_checks = regexp:/etc/postfix/header_checks" 
> inside /etc/postfix/main.cf (without the qoutes, on a line by itself)
>  and place the following inside /etc/postfix/header_checks
> 
> /^Subject: .*Armenian Genocide Plagues Ankara 90 Years On.*/   
>  DISCARD SoberQ SPAM /^Subject: .*Auf Streife durch den Berliner 
> Wedding.*/    DISCARD SoberQ SPAM /^Subject: .*Deutsche werden 
> kuenftig beim Arzt abgezockt.*/    DISCARD SoberQ SPAM /^Subject: 
> .*Du wirst zum Sklaven gemacht.*/    DISCARD SoberQ SPAM /^Subject: 
> .*Paranoider Deutschenmoerder kommt in Psychiatrie.*/    DISCARD 
> SoberQ SPAM /^Subject: .*S.O.S. Kiez! Polizei schlaegt Alarm.*/    
> DISCARD SoberQ SPAM /^Subject: .*The Whore Lived Like a German.*/    
> DISCARD SoberQ SPAM /^Subject: .*Transparenz ist das Mindeste.*/   
>  DISCARD SoberQ SPAM /^Subject: .*Turkish Tabloid Enrages Germany 
> with Nazi Compariso.*/    DISCARD SoberQ SPAM /^Subject: 
> .*Verbrechen der deutschen Frau.*/    DISCARD SoberQ SPAM /^Subject: 
> .*Volk wird nur zum zahlen gebraucht.*/    DISCARD SoberQ SPAM 
> /^Subject: .*Vorbildliche Aktion.*/    DISCARD SoberQ SPAM 
> /^Subject: .*Trotz Stellenabbau.*/    DISCARD SoberQ SPAM
> 
> Then restart postfix (service postfix restart)
> 
> Please note this is NOT a complete list! if you find anymore 
> subjects that the worm uses I would appreciate it if you sent them 
> to me.
> 
> Cheers, 
> Jordan.
------- End of Original Message -------

____________________________________________________
Want to buy your Pack or Services from MandrakeSoft? 
Go to http://www.mandrakestore.com
Join the Club : http://www.mandrakeclub.com
____________________________________________________