[Postfixbuch-users] Kettenmails und gefälschte Spendenaufrufe zur Flutkatastrophe

Thomas Grieder postfix at moonsmile.ch
Do Jan 6 13:57:10 CET 2005


Hallo Liste

Etwas vorweg: Den Titel habe ich von Heise geklaut: 
http://www.heise.de/newsticker/meldung/54823

Die erste Mail ist bei mir bereits eingetroffen und ich möchte das so 
schnell wie möglich unterbinden.

Hat schon jemand irgendwelche Regeln um solche Mails wie unten zu Blocken?

Da ich das noch nie in dieser Form gemacht habe, weiss ich nicht genau, 
wie ich die Mail "anpacken" muss. Bei den Nazi-Mails konnte ich 
bestehende Regeln einbauen.

Nach was würdet ihr Filtern?

Danke
Thomas


Return-Path: <office at explora.ch>
X-Original-To: thomas at moonsmile.ch
Delivered-To: thomas at moonsmile.ch
Received: from localhost (localhost [127.0.0.1])
	by mail.moonsmile.ch (Postfix) with ESMTP id C6E0A208FA6
	for <thomas at moonsmile.ch>; Thu,  6 Jan 2005 13:43:54 +0100 (CET)
Received: from mail.moonsmile.ch ([127.0.0.1])
	by localhost (moon [127.0.0.1]) (amavisd-new, port 10024) with ESMTP
	id 02275-01 for <thomas at moonsmile.ch>;
	Thu, 6 Jan 2005 13:43:52 +0100 (CET)
Received: from localhost (localhost [127.0.0.1])
	by mail.moonsmile.ch (Postfix) with ESMTP id 000E3208EF5
	for <thomas at moonsmile.ch>; Thu,  6 Jan 2005 13:43:51 +0100 (CET)
X-Flags: 0000
Delivered-To: GMX delivery to user at gmx.ch
Received: from pop.gmx.net
	by localhost with POP3 (fetchmail-5.9.11)
	for thomas at moonsmile.ch (single-drop); Thu, 06 Jan 2005 13:43:52 +0100 
(CET)
Received: (qmail invoked by alias); 06 Jan 2005 12:43:00 -0000
Received: from explora.ch (HELO explora.ch) (216.218.149.30)
   by mx0.gmx.net (mx006) with SMTP; 06 Jan 2005 13:43:00 +0100
Received: from PC2 ([83.76.40.216]) by explora.ch for <user at gmx.ch>; 
Thu, 6 Jan 2005 04:36:13 -0800
From: "explora.ch" <office at explora.ch>
To: <office at explora.ch>
Subject: WG: Kennt jemand diesen Jungen? Hilfsgesuch aus thail. 
Krankhaus   Khao Lak
Date: Thu, 6 Jan 2005 13:33:37 +0100
Message-ID: <000201c4f3ec$6b7ef3d0$2101a8c0 at PC2>
MIME-Version: 1.0
Content-Type: multipart/mixed;
	boundary="----=_NextPart_000_0003_01C4F3F4.CD435BD0"
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.6626
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
Importance: Normal
X-GMX-Antivirus: -1 (not scanned, may not use virus scanner)
X-GMX-Antispam: 0 (Mail was not recognized as spam)
X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at moonsmile.ch

This is a multi-part message in MIME format.

------=_NextPart_000_0003_01C4F3F4.CD435BD0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable



---------- Weitergeleitete Nachricht ----------

Von:	"Martin Abplanalp", INTERNET:m.abplanalp at bluewin.ch
Datum:	05.01.05 22:36

Betreff:Kennt jemand diesen Jungen? Hilfsgesuch aus thail. Krankhaus  =
Khao
Lak

Contents:

  1 Internet Message Header
  2 <no topic> * Binary *
  3 <no topic> * Binary: JPEG *
  4 <no topic> * Binary: JPEG *

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D Begin Part 1 =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D
Topic: Internet Message Header

=20
Nachricht

-------------------------------------------------------------------------=
---
----



Bitte an alle Freunde und Bekannte weierleiten. Herzlichen Dank.=20




 >      =20
 >Hallo=20
 >Anbei ein Foto eines Jungen aus einem  Krankenhaus in Khao Lak, der=20
 >wohl seine Eltern verloren hat. Leider sind  weder Nationali=E4t noch=20
 >irgendein anderer Hinweis auf seine Herkunft und  Identit=E4t bekannt.=20
 >Bitte sendet=20
 >diese Fotos weiter in Eurer Firma, an Eure  Freunde, Bekannte usw.=20
 >=20
 >Bei Hinweisen  wendet Euch bitte an:=20
 >=20
 >Dr. Anuroj  Tharasiriroj of Phuket International Hospital=20
 >=20
 >Tel: +66 76  249-400, <>=20
 >=20
 >=20
 >Vielen  Dank!=20
 >=20
 >=20
 >Dear Friends,=20
 >=20
 >Please take a look at the attached picture  of this victim from =
Tsunami.=20
 >=20
 >If you do not know  him, please forward his=20
 >pictures to your friends or organization in your  country for further=20
 >publication.=20
 >=20
 >This boy is about 2 years old. Found  and taken from Khao Lak Resort=20
 >Area, the southern part of Thailand. His  parents are missing. His=20
 >& identity cannot be  identified.=20
 >=20
 >Please contact Dr. Anuroj Tharasiriroj of Phuket  International =
Hospital=20
 >=20
 >Phone: +66 76  249-400, <>=20
 >=20
 >I  thank you all for extending kindness to this boy.=20
 >=20
 >With kind  regards,=20
 >=20
 >Tess Ruktapurana=20
 >Thai Airways International  PCL=20
 >=20
 >=20




----------------------- Internet Header --------------------------------
Sender: m.abplanalp at bluewin.ch
Received: from mail3.bluewin.ch (mail3.bluewin.ch [195.186.1.75])
	by siaag1ae.compuserve.com (8.12.11/8.12.7/SUN-2.17) with ESMTP id
j05LaWFg008169
	for <danielpeterlunger at compuserve.com>; Wed, 5 Jan 2005 16:36:32
-0500 (EST)
Received: from Abplanalp (83.77.43.78) by mail3.bluewin.ch (Bluewin AG
7.0.035)
         id 41C0385200115A37; Wed, 5 Jan 2005 21:35:44 +0000
Message-ID: <002c01c4f36e$25c3af30$a01bfea9 at Abplanalp>
From: "Martin Abplanalp" <m.abplanalp at bluewin.ch>
To: <<>;>
Subject:  Kennt jemand diesen Jungen? Hilfsgesuch aus thail. Krankhaus  =
Khao
Lak
Date: Wed, 5 Jan 2005 22:33:05 +0100
MIME-Version: 1.0
Content-Type: multipart/mixed;
	boundary=3D"----=3D_NextPart_000_0028_01C4F376.85DF9750"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
X-Virus-Scanned: clamd / ClamAV version 0.75.1, clamav-milter version =
0.75c
	on siaag1ae.compuserve.com
X-Virus-Status: Clean



=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D End Part 1 / =
Begin Part 2 =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

% Part 2 is binary

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D End Part 2 / =
Begin Part 3 =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Format: JPEG
Name: cimg1007.jpg

% Part 3 is binary

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D End Part 3 / =
Begin Part 4 =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Format: JPEG
Name: cimg1008.jpg

% Part 4 is binary

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D End Part 4 =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D

------=_NextPart_000_0003_01C4F3F4.CD435BD0
Content-Type: image/jpeg;
	name="CIMG1007.JPG"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
	filename="CIMG1007.JPG"



Mehr Informationen über die Mailingliste Postfixbuch-users