I am seeing randomized addresses, but they seem to be from "related industries". We are in real-estate, the address are random then @ other real-estate companies, title companies, etc.
All the e-mails that have gotten through have been from conversent.net 204.17.110.18 Probably some genius real-estate agent that got infected - I haven't looked at all the e-mails that get held yet. Marc -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Sunday, May 15, 2005 9:51 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] German political spam What are the return/sender addresses looking like? Randomized? Darrell ------------------------------------------- Check out http://www.invariantsystems.com for utilities for Declude And Imail. IMail Queue Monitoring, Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. ----- Original Message ----- From: "Marc Catuogno" <[EMAIL PROTECTED]> To: <Declude.JunkMail@declude.com> Sent: Sunday, May 15, 2005 9:34 AM Subject: RE: [Declude.JunkMail] German political spam I've added all the phases that I have found in the e-mails that got through to me. I don't do much internationally so my weighting and inclusion may be harsh for those that do. Marc -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler Sent: Sunday, May 15, 2005 3:50 AM To: Declude.JunkMail@declude.com Subject: RE: [Declude.JunkMail] German political spam Attached is the updated filter file containing 3 additional subject filter lines. Markus > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler > Sent: Sunday, May 15, 2005 9:25 AM > To: Declude.JunkMail@declude.com > Subject: RE: [Declude.JunkMail] German political spam > > > > Anyone else getting hit with massive waves of German spam as a > > byproduct of modified Sober code continuing from around 2 pm EDT > > today, or am I 'unique' in this? > > Yes, I've identified 3 tipical body phrases that can be used > to filter for. > Se atached zip/txt file. > Maybe it's incomplete and so should be updated. Please send > additional strings also in zipped ttxt files in order to > bypass already existing filters. > > Markus > --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
