Hi, Lately, we've been getting a lot of stuff like this:
Received: from mail5.slik.com.ru [194.62.0.249] by mail2.bcwebhost.net with ESMTP (SMTPD-9.20) id ABB40398; Wed, 05 Mar 2008 09:43:16 -0800 Message-ID: <[EMAIL PROTECTED]> From: =?koi8-r?B?7dXSwdfDxddh?= <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Subject: SPAM [13]=?koi8-r?B?xMzRINDSz8bJzMHL1MnLySDJIMzF3sXOydEgzc7Px8nIINrBws/MxQ==?= =?koi8-r?B?18HOyco=?= Date: Wed, 05 Mar 2008 15:54:03 +0000 MIME-Version: 1.0 Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_0007_01C87EE8.0451BBC1" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.3138 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198 X-invURIBL-Scan: Scanned by invURIBL 3.1.0 on 3/5/2008 9:47:33 AM X-invURIBL-Weight: 0 X-invURIBL-Range: CLEAN X-RBL-Warning: NOABUSE: "Not supporting [EMAIL PROTECTED]" X-RBL-Warning: NOPOSTMASTER: "Not supporting [EMAIL PROTECTED]" X-RBL-Warning: SUBCHARS-50: Subject with at least 50 characters found. X-RBL-Warning: SUBCHARS-55: Subject with at least 55 characters found. X-RBL-Warning: SUBCHARS-60: Subject with at least 60 characters found. X-RBL-Warning: SNIFFER: Message failed SNIFFER: 61. X-Declude-Sender: [EMAIL PROTECTED] [194.62.0.249] X-Declude-Spoolname: Ddbb401e000007908.smd X-Declude-Note: Scanned by Declude 4.2.20 for spam. "http://www.declude.com/x-note.htm"; X-Declude-Scan: Incoming Score [13] at 09:47:34 on 05 Mar 2008 X-Declude-Fail: NOABUSE [2], NOPOSTMASTER [1], SUBCHARS-50 [1], SUBCHARS-55 [1], SUBCHARS-60 [1], SNIFFER [7], WEIGHT5 [5], WEIGHT10 [10], WEIGHT10r [10], WEIGHT7 [7], WEIGHT7r [7], ZEROHOUR [0] X-Country-Chain: [RIPE Unlisted]->destination Where the body of the message is full of Russian. Is the best way to weight this stuff by country of origin? If so, what kind of country tests do people typically use? How severe is the CPU load on these kinds of tests? For this particular message, it get blocked as spam, but some of these messages come through as clean and I'm trying to figure how to filter for them better. Thanks, Ben --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
