> -----Original Message----- > From: Matus UHLAR - fantomas [mailto:[EMAIL PROTECTED] > Sent: Friday, 21 March 2008 3:28 a.m. > To: users@spamassassin.apache.org > Subject: Re: Cyrillic spam > > > > For some strange reason, I'm seeing Cyrillic spams very frequently > > > lately. > > > > > > None of my users read any Eastern European languages- is there a quick > > > way to catch these? > > On 20.03.08 08:54, Michael Hutchinson wrote: > > You could use the ok_languages and ok_locales settings. I'm sure > > discussions on those can be found in the archives. > > that should be enough imho. CHARSET_FARAWAY with UNWANTED_LANGUAGE give > scores high enough to be marked as spam..
That sounds great. > > I employed these rules for my site: > > > > header CST_RUSSIANSPAM1 Subject:raw =~ > > /\=\?(koi8\-r|windows\-125[0125]|windows\-874|iso\-8859\-[28])\?/i > > score CST_RUSSIANSPAM1 6.6 > > describe CST_RUSSIANSPAM1 Russian SPAM, trap Subject line for > > language set > > > > header CST_RUSSIANSPAM2 From:raw =~ > > /\=\?(koi8\-r|windows\-125[0125]|windows\-874|iso\-8859\-[28])\?/i > > score CST_RUSSIANSPAM2 6.6 > > describe CST_RUSSIANSPAM2 Russian SPAM, trap From line for > > language set > > I wonder why didn't you use the former? and also, why do you add score of > 6.6 ? The rules caught all of the Russian Spam our site was receiving, so I decided to push the score high enough that it would always be tagged as spam, no matter what route it took. I also thought it would be a good idea to understand some not-so-simple rule writing for Subject and From Email headers... > > These two rules should tag your Cyrillic spam just fine. You might > > prefer to throw the language away entirely with the ok_languages etc. > > Just depends how you want to go about it. > > the ok_* don't "throw anything entirely", they only score unwanted > charsets > and languagees. Ok so the wording may have been incorrect, but as far as the end-user is concerned, it is being thrown away, as their filters (at least on our sites) prevent them from seeing anything tagged with 5 or more points. Anyway, lets stop barking up my rules, and agree there's more than one way to do it, and my way works for my site and your way works for your site. Cheers, Mike
