In an older episode (Sunday 15 May 2005 12:44), Raymond Dijkxhoorn wrote:
Hi!
Anyone has a full list of subjects yet, time to do some SA magic... ;)
I have quite a few, here is the subjects list:
Subject: 4,8 Mill. Osteuropaeer durch Fischer-Volmer Erlass Subject: Auf Streife durch den Berliner Wedding Subject: Auslaender bevorzugt Subject: Auslaenderpolitik Subject: DON'T DELETE THIS MESSAGE -- FOLDER INTERNAL DATA Subject: Deutsche werden kuenftig beim Arzt abgezockt Subject: Du wirst zum Sklaven gemacht!!! Subject: Graeberschaendung auf bundesdeutsche Anordnung Subject: Hier sind wir Lehrer die einzigen Auslaender Subject: Paranoider Deutschenmoerder kommt in Psychiatrie Subject: Tuerkei in die EU Subject: Verbrechen der deutschen Frau
Two more:
Subject: Vorbildliche Aktion Subject: 60 Jahre Befreiung: Wer feiert mit?
one more: Subject: Augen auf
I noticed that the WS URIBL does by now recognize various of the URIs in those mails, and a rule like
# whois.rfc-ignorant.org URIBL http://www.rfc-ignorant.org/
urirhssub URIBL_RFCI_WHOIS whois.rfc-ignorant.org. A 5
body URIBL_RFCI_WHOIS eval:check_uridnsbl('URIBL_RFCI_WHOIS')
describe URIBL_RFCI_WHOIS URL listed at rfc-ignorant.org (whois)
tflags URIBL_RFCI_WHOIS net
also works well here:
1.0 URIBL_RFCI_WHOIS URL listed at rfc-ignorant.org (whois) [URIs: pro-koeln-online.de jungefreiheit.de] [g-d-f.de bewaeltigen.de kopfmord.de] [buergerbewegungen.de wk-institut.de] [das-gibts-doch-nicht.de un-nachrichten.de] [rocknord.de]
And may cause LOTS of false positives as well
Sun 2005-05-15 13:42:18: * 1.0 URIBL_RFCI_WHOIS URL listed at rfc-ignorant.org (whois)
Sun 2005-05-15 13:42:18: * [URIs: spiegel.de npd.de taz.de]
FP: spiegel.de & taz.de
Sun 2005-05-15 13:42:44: * 1.0 URIBL_RFCI_WHOIS URL listed at rfc-ignorant.org (whois)
Sun 2005-05-15 13:42:44: * [URIs: libasoli.de zdf.de]
FP: zdf.de
h2h
Alex
