On Thu, 10 Jun 2004, John Fawcett wrote: [...] > > > > John > > > I spoke too soon, now they're starting to break through. My guess is they're > coming from > exploited machines that haven't made it into blocking lists.
a german internet news site has an article about it: http://www.heise.de/newsticker/meldung/48135 they think those spam is comming from infected win machines (sober.g) since this morning those infected machines sending out those political spam. in a related forum somone wrote a sa rule, capturing those subject, spammers are using - needs some linebreaks, or maybe done as a meta rule - bit too long for my taste :) http://www.heise.de/newsticker/foren/go.shtml?read=1&msg_id=5832449&forum_id=57381 regards, Matthias
