>Message-ID: <[EMAIL PROTECTED]> >From: "Mike Kuentz (2)" <[EMAIL PROTECTED]> >To: [EMAIL PROTECTED] >Subject: [SAtalk] [RD] Subject rule question >X-Original-Date: Tue, 9 Sep 2003 15:04:25 -0400 >Date: Tue, 9 Sep 2003 15:04:25 -0400 >Status: R > Hi Mike,
RE: [SAtalk] [RD] Subject rule question I chased this for a while too, and after failing miserably with SpamAssassin ( no doubt my fault, not SAs, I was in a hurry ) here's what I did. My end delivery is somewhat draconian, change your end target to suit. The redundancy is for some debugging in progress, check $HOME/procmail.log to see which one actually traps what you're getting. Corrections, improvements welcome and solicited. ------ cut here ----- DROPPRIVS=yes VERBOSE=YES LOGFILE=$HOME/procmail.log # feed it to spamc first :0fw * < 256000 | spamc # regardless of outcome, dump it. :0H * ^Subject:.*ISO-8859-1.* !bit-bucket :0H * ^Subject:.*[Ii][Ss][Oo]-8859-1.* !bit-bucket ------ cut here ----- SA is a phenomenal product, and Procmail is one of the Doomsday Buttons Of Last Resort for UCE as well. :) Good Luck G.F. Boyd VTA.COM / VTA Technologies [EMAIL PROTECTED] >I see a lot of spams coming through hiding the subject masked using >ISO-8859, like this > >Subject: =?ISO-8859-1?b?SGFsZiBQcmljZWQgU2lsZGVuYWZpbCBDaXRyYXRl?= > >which translates back to a subject of: > >Half Priced Sildenafil Citrate > >obviously I can look for "Half Priced Sildenafil Citrate" in the subject, >but I want to write a rule for ISO-8859 in the subject. I have this rule, >but it doesn't appear to hit. > >header MK_CHARSET_IN_SUBJECT Subject =~ /ISO\-8859/i > >Does SA translate that before hand and that's why it's not hitting? It's >obviously a big thing for spammers, since a search on groups.google.com for >ISO-8859 turns up tons of results from news.admin.net-abuse.sightings. > >Mike > > ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
