From the spam-l list:
X-AV-Checked: Mon May 16 19:15:05 2005 virusgate.meiway.com
Received: from mgw1.meiway.com (mgw1.meiway.com [81.255.84.75])
by VirusGate.MEIway.com (Postfix) with ESMTP id 60681386680
for <[EMAIL PROTECTED]>; Mon, 16 May 2005 19:15:05 +0200 (CEST)
(envelope-from [EMAIL PROTECTED])
Received: from cherry.ease.lsoft.com (cherry.ease.lsoft.com [209.119.0.109])
by mgw1.meiway.com (Postfix) with ESMTP id 9241C4718D5
for <[EMAIL PROTECTED]>; Mon, 16 May 2005 19:15:04 +0200 (CEST)
(envelope-from [EMAIL PROTECTED])
Received: from vms.dc.lsoft.com (209.119.0.2) by cherry.ease.lsoft.com (LSMTP for Digital Unix v1.1b) with SMTP id <[EMAIL PROTECTED]>; Mon, 16 May 2005 13:14:59 -0400
Received: by PEACH.EASE.LSOFT.COM (LISTSERV-TCP/IP release 14.3) with spool id
71035542 for [EMAIL PROTECTED]; Mon, 16 May 2005 13:14:58
-0400
Received: from 131.161.246.241 by WALNUT.EASE.LSOFT.COM (SMTPL release 1.0l)
with TCP; Mon, 16 May 2005 13:14:58 -0400
Received: from feynman.cliq.com (IDENT:[EMAIL PROTECTED] [127.0.0.1]) by
feynman.cliq.com (8.12.9/8.12.2) with ESMTP id j4GH59Fe022670 for
<[EMAIL PROTECTED]>; Mon, 16 May 2005 10:05:09 -0700 (PDT)
Received: (from [EMAIL PROTECTED]) by feynman.cliq.com
(8.12.9/8.12.1/Submit) id j4GH596I002609 for
[EMAIL PROTECTED]; Mon, 16 May 2005 10:05:09 -0700 (PDT)
X-URL: http://www.spambouncer.org
X-No-Markup: Yes
X-Mailer: ELM [version 2.4ME+ PL66 (25)]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Message-ID: <[EMAIL PROTECTED]>
Date: Mon, 16 May 2005 10:05:09 -0700
Sender: Spam Prevention Discussion List <[EMAIL PROTECTED]>
From: Catherine Hampton <[EMAIL PROTECTED]>
Subject: Re: Spam: The Whore Lived Like a German
To: [EMAIL PROTECTED]
In-Reply-To: <[EMAIL PROTECTED]> from Joel Rubin
at "May 15, 2005 04:24:41 pm"
Precedence: list
X-RCPT-TO: <[EMAIL PROTECTED]>
Status: U
X-UIDL: 380070079
> As has been previously reported in Spam-L there has been a flood of > German language spam from various zombie IP's around the world.
<snip>
This is a second spam run by the owners/operators of the Sober Worm/Virus trojan proxy network, probably to test out a new version of Sober (Sober-Q, according to F-Prot) or to demonstrate their network to a potential customer/potential customers. Surely the rest of you remember the "NAZI spam" run last year? <wry grin> Same folks, same theme, same tactics.
I updated the SpamBouncer last night to catch this cr*p, and the SpamAssassin team released a set of SpamAssassin filters to do the same. I suggest updating your filters.
-- Catherine Hampton <[EMAIL PROTECTED]> The SpamBouncer * <http://www.spambouncer.org/> Personal Home Page * <http://www.devsite.org/>
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
