Hi Cristobal,
I second Daniel's method: filter by the charset. At some point I used to get
a lot of korean and chinese spam (what the heck? yeah), then I looked into
the e-mail headers, there was one 'charset-like', which I started to filter,
and that did it for me.
Just one thing: Windows-1251 is *one* of the charsets for Russian. There are
others. Right now I recall KOI-8 (or something like that), and I believe
there was one like iso-8859-X -> sorry, I dont really recall X's value.
The best way, however, is to check for the values in the spams you are
actually getting.
[]s,
Алексей ;-)
PS: No, the spam is NOT coming from me :P
On 1/28/07, Daniel Sterling <[EMAIL PROTECTED]> wrote:
Cristóbal Palmer wrote:
> We're already using content checks... and other techniques.
Excellent! I hate to be repetitive, but please keep using statistical
analysis! I run spamassassin with the bayes *off*. Spam that
spamassassin misses is filtered by Thunderbird's built in statistical
analysis. I have a silly setup like this mostly because it works and I
am too lazy to change it.
Anyway, my Thunderbird's filters are catching the Cyrillic spam. I
noticed that the following fun keyword is in mine:
charset="windows-1251"
windows-1251 is the Cyrillic encoding. You can definitely trash messages
with that string.
Also, you may or may not have good luck with the following bit of regex:
[\x{400}-\x{52f}] -- let me know! (I suppose it mostly depends on whether or
not the string to be matched against is using byte or character semantics.)
-- Dan
--
TriLUG mailing list : http://www.trilug.org/mailman/listinfo/trilug
TriLUG Organizational FAQ : http://trilug.org/faq/
TriLUG Member Services FAQ : http://members.trilug.org/services_faq/
--
Alexei Znamensky - russoz_gmail_com
Notícias do Front: http://russoz.wordpress.com/
::: Remember, remember the 5th of November
--
TriLUG mailing list : http://www.trilug.org/mailman/listinfo/trilug
TriLUG Organizational FAQ : http://trilug.org/faq/
TriLUG Member Services FAQ : http://members.trilug.org/services_faq/
