Spam Filter ISP Forums : Blocking Russian spam https://www.logsat.com/spamfilter/forums/ Tue, 17 Mar 2026 04:46:49 +0000 Fri, 19 May 2006 08:49:22 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 11.04 360 https://www.logsat.com/spamfilter/forums/RSS_post_feed.asp?TID=5418 <![CDATA[Spam Filter ISP Forums]]> https://www.logsat.com/spamfilter/forums/forum_images/web_wiz_forums.png https://www.logsat.com/spamfilter/forums/ <![CDATA[Blocking Russian spam : Thanks, Roberto and Dan. Turns...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5418&PID=8053&title=blocking-russian-spam#8053 Author: sgeorge
Subject: 5418
Posted: 19 May 2006 at 8:49am

Thanks, Roberto and Dan.  Turns out that I don't need to worry about filtering the mail from - because Dan is exactly right - every one of these messages has a subject that begins with =?windows-1251.....

Sometimes it just really helps to have a second pair of eyes to catch the stuff that you glance over!

Thank you both for your help,
Stephen
]]> Fri, 19 May 2006 08:49:22 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5418&PID=8053&title=blocking-russian-spam#8053 <![CDATA[Blocking Russian spam : AND ... I have verified that but...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5418&PID=8043&title=blocking-russian-spam#8043 Author: Desperado
Subject: 5418
Posted: 17 May 2006 at 6:44pm

AND ... I have verified that but did not get around to answering yet!  Sorry

How about that subject"
Subject: =?windows-1251?B?wfP14+Dr8uXw6P8sIOru8u7w4P8g8ODh7vLg5fI=?=

I can block that if tthe =?windows is actually in the header.



Edited by Desperado]]> Wed, 17 May 2006 18:44:04 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5418&PID=8043&title=blocking-russian-spam#8043 <![CDATA[Blocking Russian spam : SpamFilter will check the email...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5418&PID=8041&title=blocking-russian-spam#8041 Author: LogSat
Subject: 5418
Posted: 17 May 2006 at 6:25pm

SpamFilter will check the email address specified in the MAIL FROM command.

The "From" in question is an email header, which is different from the MAIL FROM address. SpamFilter ignores the "From" header when checking email addresses.

The From: =?windows-1251?B?1Ojt4O3x7uLu7PMgxOjw5ery7vDz?=
unfortunately cannot be scanned right now for keywords as it's not a "Received:" header, sorry...
]]> Wed, 17 May 2006 18:25:05 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5418&PID=8041&title=blocking-russian-spam#8041 <![CDATA[Blocking Russian spam : Sounds great. Just as long as...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5418&PID=8032&title=blocking-russian-spam#8032 Author: sgeorge
Subject: 5418
Posted: 17 May 2006 at 3:04pm

Sounds great.  Just as long as I don't have to do the work (kidding!).  Thanks Dan!

Stephen
]]> Wed, 17 May 2006 15:04:03 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5418&PID=8032&title=blocking-russian-spam#8032 <![CDATA[Blocking Russian spam : Stephen, Not sure ... Need to...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5418&PID=8030&title=blocking-russian-spam#8030 Author: Desperado
Subject: 5418
Posted: 17 May 2006 at 2:34pm

Stephen,

Not sure ... Need to ask Roberto.  Or ... let me do a test.



Edited by Desperado]]> Wed, 17 May 2006 14:34:08 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5418&PID=8030&title=blocking-russian-spam#8030 <![CDATA[Blocking Russian spam : Good call Dan! Yes, that From:...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5418&PID=8029&title=blocking-russian-spam#8029 Author: sgeorge
Subject: 5418
Posted: 17 May 2006 at 2:15pm

Good call Dan!  Yes, that From: line that I have is as I received it.  But I always suspected SpamFilter would only care about what's in the <>s when checking the Mail From Blacklist.  Will it scan whatever "name" is outside of the <>s as well?

Stephen
]]> Wed, 17 May 2006 14:15:50 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5418&PID=8029&title=blocking-russian-spam#8029 <![CDATA[Blocking Russian spam : Steve, Are your &#034;Froms&#034;...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5418&PID=8028&title=blocking-russian-spam#8028 Author: Desperado
Subject: 5418
Posted: 17 May 2006 at 1:52pm

Steve,

Are your "Froms" really in the format of "From: =?windows-1251?B?1Ojt4O3x7uLu7PMgxOjw5ery7vDz?= <arboretum@surfeador.com>"

The = And ? are not leagal chars in a from and a RegEx ought to do something usefull.

]]> Wed, 17 May 2006 13:52:45 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5418&PID=8028&title=blocking-russian-spam#8028 <![CDATA[Blocking Russian spam : Alan, a good thought. And I tried...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5418&PID=8026&title=blocking-russian-spam#8026 Author: sgeorge
Subject: 5418
Posted: 17 May 2006 at 1:12pm

Alan, a good thought.  And I tried to employ a keyword block on charset="windows-1251" - but like a moron, I forgot that it's not in a Received: header, and hence won't be scanned even if I have ScanReceivedHeaders=1 set.

Anyone have any luck blocking spam with Russian text?  When I geo-ip some of the i.p.s, the smtp servers appear to not be in Russia, so blocking by country may not even be an effective solution.  The headers usually look like this:


Microsoft Mail Internet Headers Version 2.0
Received: from mail ([10.10.10.1]) by mail.moi.local with Microsoft SMTPSVC(6.0.3790.1830);
     Wed, 17 May 2006 08:06:11 -0400
Received: from 1.2.3.4 by mail.mydomain.com (LogSat Software SMTP Server - Unlicensed Evaluation Copy) Wed, 17 May 2006 08:06:10 -0400
Received: from 168.226.236.252 (unknown [168.226.236.252])
    by my.mailbackup.com (ConcentricHost(2.54) MX) with SMTP id 67DB93321
    for <user@mydomain.com>; Wed, 17 May 2006 08:05:47 -0400 (EDT)
Message-ID: <1c1101c67933$e0e7484d$c5f74522@surfeador.com>
From: =?windows-1251?B?1Ojt4O3x7uLu7PMgxOjw5ery7vDz?= <arboretum@surfeador.com>
To: user@mydomain.com
Subject: =?windows-1251?B?wfP14+Dr8uXw6P8sIOru8u7w4P8g8ODh7vLg5fI=?=
Date: Wed, 17 May 2006 00:52:27 +0300
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="----=_NextPart_000_0000_63BFC216.621FEDAC"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express V6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
X-Server: LogSat Software SMTP Server - Unlicensed Evaluation Copy
X-SF-RX-Return-Path: <arboretum@surfeador.com> BODY=8BITMIME
X-SF-HELO-Domain: my.mailbackup.com
Return-Path: arboretum@surfeador.com
X-OriginalArrivalTime: 17 May 2006 12:06:11.0054 (UTC) FILETIME=[497678E0:01C679AA]

------=_NextPart_000_0000_63BFC216.621FEDAC
Content-Type: text/plain;
    charset="windows-1251"
Content-Transfer-Encoding: 8bit

------=_NextPart_000_0000_63BFC216.621FEDAC
Content-Type: text/html;
    charset="windows-1251"
Content-Transfer-Encoding: quoted-printable


------=_NextPart_000_0000_63BFC216.621FEDAC--



For now, I'm going to try to block specific, frequent letter sequence in Russian and hope that I block Russian, without blocking the occasional legit French and Spanish text that we receive.

Stephen
]]> Wed, 17 May 2006 13:12:53 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5418&PID=8026&title=blocking-russian-spam#8026 <![CDATA[Blocking Russian spam : If truly Russian text, maybe block...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5418&PID=6964&title=blocking-russian-spam#6964 Author: Alan
Subject: 5418
Posted: 15 December 2005 at 4:42pm

If truly Russian text, maybe block keywords "charset=windows-1251" in the header for now?

Of course there are many other ways for Russian spammers to get around this too.
]]> Thu, 15 Dec 2005 16:42:38 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5418&PID=6964&title=blocking-russian-spam#6964 <![CDATA[Blocking Russian spam : Al, Blocking emails with certains...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5418&PID=6962&title=blocking-russian-spam#6962 Author: LogSat
Subject: 5418
Posted: 15 December 2005 at 4:35pm

Al,

Blocking emails with certains charsets is among the next features thatwill soon be added. Right now we're looking at a 1-2 months timeframefor it.
]]> Thu, 15 Dec 2005 16:35:29 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5418&PID=6962&title=blocking-russian-spam#6962