[TriLUG] stopping Cyrillic spam.

[Alexei Znamensky]

Hi Cristobal,

I second Daniel's method: filter by the charset. At some point I used to get
a lot of korean and chinese spam (what the heck? yeah), then I looked into
the e-mail headers, there was one 'charset-like', which I started to filter,
and that did it for me.

Just one thing: Windows-1251 is *one* of the charsets for Russian. There are
others. Right now I recall KOI-8 (or something like that), and I believe
there was one like iso-8859-X -> sorry, I dont really recall X's value.

The best way, however, is to check for the values in the spams you are
actually getting.

[]s,
Алексей ;-)

PS: No, the spam is NOT coming from me :P

On 1/28/07, Daniel Sterling <dan at lost-habit.com> wrote:
>
> Cristóbal Palmer wrote:
> > We're already using content checks... and other techniques.
> Excellent! I hate to be repetitive, but please keep using statistical
> analysis! I run spamassassin with the bayes *off*. Spam that
> spamassassin misses is filtered by Thunderbird's built in statistical
> analysis. I have a silly setup like this mostly because it works and I
> am too lazy to change it.
>
> Anyway, my Thunderbird's filters are catching the Cyrillic spam. I
> noticed that the following fun keyword is in mine:
>
> charset="windows-1251"
>
> windows-1251 is the Cyrillic encoding. You can definitely trash messages
> with that string.
>
> Also, you may or may not have good luck with the following bit of regex:
> [\x{400}-\x{52f}] -- let me know! (I suppose it mostly depends on whether or
> not the string to be matched against is using byte or character semantics.)
>
> -- Dan
>
>
> --
> TriLUG mailing list        : http://www.trilug.org/mailman/listinfo/trilug
> TriLUG Organizational FAQ  : http://trilug.org/faq/
> TriLUG Member Services FAQ : http://members.trilug.org/services_faq/
>



-- 
Alexei Znamensky - russoz_gmail_com
Notícias do Front: http://russoz.wordpress.com/
::: Remember, remember the 5th of November