There are a few missing from Joe Wein's list, but I thought Markus' list is complete.
Here are the ones that I found that needed to be added: Dr--esden Bombing Is To Be R--egretted Enormously The Wh--ore Lived Like a G--erman Tu--rkish Tabloid Enrages Ge--rmany with Na--zi Comparisons Arm--enian Genoc--ide Plagues An--kara 90 Years On (I've sprinkled "--" through the samples to perhaps escape text filtering) Also, Markus' optimization of checking CMDSPACE before SUBJECT checking will not work in two cases: 1) If your mailsystem is based on Smartwhatever, this test is not available, so you will never execute the SUBJECT tests. 2) You will fail to catch "blow back" messages like "re: Tu--rkish Tabloid ..." and "Out of office: Tu--rkish Tabloid ..." and "Undeliverable: Tu--rkish Tabloid ..." so I suggest that unless you are catching 2) elsewise, then don't try to use the CMDSPACE short-circuit optimization. Andrew 8) -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser Sent: Tuesday, May 17, 2005 12:17 PM To: [email protected] Subject: Re: [Declude.JunkMail] German political spam Has anyone but me noticed that the "german spam" subjects appear to be changing? We just blocked on that has the subject "Armenian Genocide Plagues Ankara 90 Years On" but that's not on any of the lists that I have seen. Thanks, Dan ----- Original Message ----- From: "Markus Gufler" <[EMAIL PROTECTED]> To: <[email protected]> Sent: Monday, May 16, 2005 5:49 PM Subject: RE: [Declude.JunkMail] German political spam > If someone is interested in, I've updated my sober-q filter files. > I've split the patterns in two files: SUBJECT and BODY lines. They > will not catch more but: > > 1.) The SUBJECT filterfile will be processed only if CMDSPACE has > failed before. This will save resources and as some subject lines can > be used also in legit german messages it will prevent FP's. > > 2.) The BODY-file is primary there to filter out bounces so it cannot > be combined with CMDSPACE but at least it can be skipped if the > SUBJECT-based filterfile has already failed. > > In addition both filterfiles will now STOPATFIRSTHIT. > > Here are the config lines for both filterfiles: > > SOBERQ filter C:\[filter_path]\filter_soberq.txt x 0 > 0 > SOBERQBODY filter C:\[filter_path]\filter_soberq-body.txt x 0 0 > > Markus > ------------------------------------------------------------------- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
