Do you expect to receive russian messages (other than spam) if not than
you can filter by charset "koi8-r". Charset filtering is not CPU intensive.
Darrell
----------------------------------
Check out http://www.invariantsystems.com for utilities for Declude,
Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring,
SURBL/URI integration, MRTG Integration, and Log Parsers.
Imail Admin wrote:
Hi,
Lately, we've been getting a lot of stuff like this:
Received: from mail5.slik.com.ru [194.62.0.249] by mail2.bcwebhost.net
with ESMTP
(SMTPD-9.20) id ABB40398; Wed, 05 Mar 2008 09:43:16 -0800
Message-ID: <[EMAIL PROTECTED]
<mailto:[EMAIL PROTECTED]>>
From: =?koi8-r?B?7dXSwdfDxddh?= <[EMAIL PROTECTED]
<mailto:[EMAIL PROTECTED]>>
To: <[EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]>>
Subject: SPAM
[13]=?koi8-r?B?xMzRINDSz8bJzMHL1MnLySDJIMzF3sXOydEgzc7Px8nIINrBws/MxQ==?=
=?koi8-r?B?18HOyco=?=
Date: Wed, 05 Mar 2008 15:54:03 +0000
MIME-Version: 1.0
Content-Type: multipart/related;
type="multipart/alternative";
boundary="----=_NextPart_000_0007_01C87EE8.0451BBC1"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.3138
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198
X-invURIBL-Scan: Scanned by invURIBL 3.1.0 on 3/5/2008 9:47:33 AM
X-invURIBL-Weight: 0
X-invURIBL-Range: CLEAN
X-RBL-Warning: NOABUSE: "Not supporting [EMAIL PROTECTED] <mailto:[EMAIL
PROTECTED]>"
X-RBL-Warning: NOPOSTMASTER: "Not supporting [EMAIL PROTECTED]
<mailto:[EMAIL PROTECTED]>"
X-RBL-Warning: SUBCHARS-50: Subject with at least 50 characters found.
X-RBL-Warning: SUBCHARS-55: Subject with at least 55 characters found.
X-RBL-Warning: SUBCHARS-60: Subject with at least 60 characters found.
X-RBL-Warning: SNIFFER: Message failed SNIFFER: 61.
X-Declude-Sender: [EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]>
[194.62.0.249]
X-Declude-Spoolname: Ddbb401e000007908.smd
X-Declude-Note: Scanned by Declude 4.2.20 for spam.
"http://www.declude.com/x-note.htm";
X-Declude-Scan: Incoming Score [13] at 09:47:34 on 05 Mar 2008
X-Declude-Fail: NOABUSE [2], NOPOSTMASTER [1], SUBCHARS-50 [1],
SUBCHARS-55 [1], SUBCHARS-60 [1], SNIFFER [7], WEIGHT5 [5], WEIGHT10
[10], WEIGHT10r [10], WEIGHT7 [7], WEIGHT7r [7], ZEROHOUR [0]
X-Country-Chain: [RIPE Unlisted]->destination
Where the body of the message is full of Russian.
Is the best way to weight this stuff by country of origin? If so, what
kind of country tests do people typically use? How severe is the CPU
load on these kinds of tests? For this particular message, it get
blocked as spam, but some of these messages come through as clean and
I'm trying to figure how to filter for them better.
Thanks,
Ben
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
--
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
