Actually, looking at this again I checked yesterday's log files. It seems that most of the domains were starting to be caught on SURBL and other URI lists around 8pm Eastern.
2005-05-14 20:02:57.171 2005-05-14 20:02:57.296 E:\IMAIL\SPOOL\D91ACBA660122CE0A.SMD rocknord.de 127.0.0.4 on multi.surbl.org [4] [Total Weight=2] 2005-05-14 21:47:07.609 2005-05-14 21:47:08.828 E:\IMAIL\SPOOL\DAA10CCE60118147C.SMD spiegel.de 127.0.0.2 on multi.surbl.org [2] [Total Weight=7] 2005-05-14 21:48:01.046 2005-05-14 21:48:02.328 E:\IMAIL\SPOOL\DAA4D12BC0264FFE5.SMD npd.de 127.0.0.2 on multi.surbl.org [2] [Total Weight=7] 2005-05-14 21:50:54.968 2005-05-14 21:50:55.281 E:\IMAIL\SPOOL\DAAFBBD960122AAD1.SMD rp-online.de 127.0.0.2 on multi.surbl.org [2] [Total Weight=7] Darrell ------------------------------------------------------------------------- invURIBL - Intelligent URI Filtering. Stops 85%+ SPAM with the default configuration. Download a copy today - http://www.invariantsystems.com ----- Original Message ----- From: "Darrell ([EMAIL PROTECTED])" <[EMAIL PROTECTED]> To: <Declude.JunkMail@declude.com> Sent: Sunday, May 15, 2005 10:02 AM Subject: Re: [Declude.JunkMail] German political spam > Markus, > > I have noticed that most of these messages at the start of this campaign > were getting caught on SURBL using invURIBL. Do you know anything about > that domain listed below? > > 2005-05-15 00:19:19.890 2005-05-15 00:19:19.968 > E:\IMAIL\SPOOL\DCDC4C1BB006E894A.SMD libasoli.de 127.0.0.2 on > multi.surbl.org [2] [Total Weight=7] > > Darrell > > ------------------------------------------- > invURIBL - Intelligent URI Filtering. Stops 85%+ SPAM with the default > configuration. Download a copy today - http://www.invariantsystems.com > > > ----- Original Message ----- > From: "Markus Gufler" <[EMAIL PROTECTED]> > To: <Declude.JunkMail@declude.com> > Sent: Sunday, May 15, 2005 3:37 AM > Subject: RE: [Declude.JunkMail] German political spam > > > > > Anyone else getting hit with massive waves of German spam as > > > a byproduct of modified Sober code continuing from around 2 > > > pm EDT today, or am I 'unique' in this? > > > > Update: > > I've noted that this type of messages always will fail CMDSPACE > > > > Please take care that the links that are part of the message body does not > > have to do anything with the initiator(s) of this messages. > > > > For example > > www.heise.de is an important german computer magazine and always strive > for > > announcing security risk, spam tecniques and so on. > > www.spiegel.de is a big german magazine and I'm 100% sure that it has > > nothing to do with this type of spam. > > > > Largely blocking this URI's in Blacklists maybe it's exactly what this > > spammers want. > > > > Markus > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
