On 27 Jul 2004 at 0:30, Ashley M. Kirchner wrote: > Every day you come up with a way to block charsets you don't want, and > someone makes a better idiot. So here's the next "problem". How do I > scan and properly block these? Notice the 'big5' charset > > Subject: > =?big5?Q?=A7=D6=A8=D3=B3=F8=A6W->=A1u=A5x=B4=C1=AB=FC=C4=B9=AEa=AFZ=A1v=A7K=B6O=C1=BF=AEy?=
The "raw" scans of SpamAssassin (they don't interpret MIME and encodings) can catch this sort of thing. I use a few extra rulesets, but I was catching this before I started using them. Make sure you have the following in your SA config file, and you should at least get the e-mail marked as SPAM: ok_locales en ok_languages en If you change the scoring for these rules, you can make the score high enough to meet a "drop" threshold. Some of the rules that work with this (and their default scores in SA 2.63): score BODY_8BITS 1.500 score CHARSET_FARAWAY 3.200 score CHARSET_FARAWAY_HEADER 3.200 score HTML_CHARSET_FARAWAY 0.500 score MIME_CHARSET_FARAWAY 2.450 score UNWANTED_LANGUAGE_BODY 2.800 -- Jeff Rife | Coach: How's a beer sound, Norm? SPAM bait: | [EMAIL PROTECTED] | Norm: I dunno. I usually finish them before [EMAIL PROTECTED] | they get a word in. _______________________________________________ Visit http://www.mimedefang.org and http://www.canit.ca MIMEDefang mailing list [EMAIL PROTECTED] http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
