Russian? spam

[hankfoner]

I have suddenly been getting a lot of spam which is in Russian (I think) and which passes through the FM personal spam filter. Anyone else having the same problem?

As I don't know anyone who would write to me in Russian is there a way to prevent Russian (or for that matter any other specific language) e-mails from passing through the filter?

Hank

[ChinaLamb]

Originally Posted by hankfoner

I have suddenly been getting a lot of spam which is in Russian (I think) and which passes through the FM personal spam filter. Anyone else having the same problem?

As I don't know anyone who would write to me in Russian is there a way to prevent Russian (or for that matter any other specific language) e-mails from passing through the filter?

Hank

not seeing that here... What have you been looking at??

[hankfoner]

Originally Posted by ChinaLamb

not seeing that here... What have you been looking at??

Well not that anyway!! It comes to a very old address which POP's over to FM. Interestingly, I have not used that address for outgoing mail for probably 6 years so they must have harvested it from someone who sends to me.
Hank

[n5bb]

Originally Posted by hankfoner

... As I don't know anyone who would write to me in Russian is there a way to prevent Russian (or for that matter any other specific language) e-mails from passing through the filter?

Please look at the full headers of several of these troublesome messages. Here are the headers (near the top) to look for:

• X-Spam-source:
• X-Spam-charsets:

Are there things in these problem messages which show up reliably in these two headers? These show the apparent country of origin, the apparent domain or origin, and the character sets used in the message. If you can find such headers which usually show up in the problem messages, use Reject as follows:

• Reject:
• Message with Any Header that Contains the text {header item}
• Silent: check
• Add
• Done

Or File into folders as follows:

• 
  File into folders:
• Message with Any Header that Contains the text {header item}
• File into folder: Junk Mail
• Flag: Check if you don't want the auto-delete property to delete these messages as you have possibly specified in the Folders screen for that folder.
• Add
• Done

Bill

[hankfoner]

Originally Posted by n5bb

Please look at the full headers of several of these troublesome messages. Here are the headers (near the top) to look for:

• X-Spam-source:
• X-Spam-charsets:

Are there things in these problem messages which show up reliably in these two headers? These show the apparent country of origin, the apparent domain or origin, and the character sets used in the message. If you can find such headers which usually show up in the problem messages, use Reject as follows:

• Reject:
• Message with Any Header that Contains the text {header item}
• Silent: check
• Add
• Done

Or File into folders as follows:

• 
  File into folders:
• Message with Any Header that Contains the text {header item}
• File into folder: Junk Mail
• Flag: Check if you don't want the auto-delete property to delete these messages as you have possibly specified in the Folders screen for that folder.
• Add
• Done

Bill

Hi Bill,
Thanks for the reply. Surprise surprise! Here is what I get:

X-Spam-source: IP='192.115.104.88', Host='pop.actcom.net.il', Country='IL',
FromHeader='com', MailFrom='com'
X-Spam-charsets: from='koi8-r', subject='koi8-r', plain='koi8-r', html='koi8-r'

Can these be coming from Israel?! Maybe from someone down my street?! The actcom.net.il is the domain of my old ISP who has now been swallowed up by someone else, but I still have an email address there.

Maybe it's enough if I reject the character set part? And where do I put the reject rule?

Hank

[n5bb]

Yes, you can classify all KOI8-R encoded messages as spam. Assuming that you are not using a custom Sieve script, here is how I would do this:

• Enter the Options>Define Rules>File into folders screen.
• Add a new File into folders rule with the following settings:
• Message with: Any Header
• That: Contains
• The text: koi8-r
• File into folder: Junk Mail
• Flag: check (see explanation)
• Order: 0 (see explanation)
• Click Add, then Done at the top of the screen to save.

Explanation for how this works:

• Spam classification: All messages in which any header (including the subject) contains the character string "koi8-r" (case insensitive) will be filed into your Junk Mail folder. This will include any use of "koi8r" in theX-Spam-charsets header. However, this doesn't really change the spam rating in the headers -- instead, this acts exactly like you manually moved the message to the Junk Mail folder.
  
• Flag enabled: In the Options>Folders screen you can set your Junk Mail folder to auto-purge (permanently delete) messages after a certain delay (such as one week). However, messages which are flagged won't be auto-purged. So if you check the Flag box all messages filed in Junk Mail by this rule won't be automatically deleted, so this rule is reasonably safe. You can, of course, manually delete them.
• Order setting: If you set your File into folders rules to all have order "0", then the File into folders rules will be executed in the order you see on the Define Rules screen. The lower numbered rules are executed first, so if you want to execute this new rule before other filing rules you should set the new rule to order "0" and set the order for all other rules to a higher number (such as "10").

Uses to classify other headers as Junk Mail: You can user the same technique to file based on the contents of any other header. But be careful -- the procedure above looks at any header (including the subject), and files to Junk Mail even if the spam score is 0.

More reliable (and more complex) rule: If you want to only file to Junk Mail based on the single X-Spam-charsets header and when the spam score is 1 or greater, use the following more complex setup. You can cut/paste using Ctrl-c/Ctrl-v from this screen into your rules setup window.

• Enter the Options>Define Rules>File into folders screen.
• Add a new File into folders rule with the following settings:
• Message with: Advanced
• That: N/A (ignored)
• The text: allof(header:contains "X-Spam-charsets" "koi8-r",header:value"ge":comparator"i;ascii-numeric""X-Spam-score""1")
• File into folder: Junk Mail
• Flag: check (see explanation)
• Order: 0 (see explanation)
• Click Add, then Done at the top of the screen to save.

Bill

[hankfoner]

Wow Bill!!,

Thanks very much. I'll try it. I'll be away for 2 weeks so it may have to wait till I get back. At a first reading it seems easiest just to junk all Russian - I cannot read it even if it isn't junk. If there are problems I'll let you know!

Best wishes,

Hank

[hankfoner]

Well I got time to try it and managed to build a rule! Apparently one has to enter the zero.

I then tried forwarding one of the Russian messages to myself - but it passed the filter. When I looked at the headers I see it had been changed to the UTF-8 character set, so I guess I'll have to wait for a real one. It got through the G-mail filter too - though not when I tried "redirect".

Thanks again and we see again how flexible FM is!
Hank

[JRobert]

Originally Posted by hankfoner

I then tried forwarding one of the Russian messages to myself - but it passed the filter.

You might get better results by redirecting it to yourself. Redirect leaves the old headers intact rather than creating a set of new ones.

[ribrob]

I would be great to be able to search folders for emails that have already made it past filtering process. Can this sieve filter be reproduced as an custom search?

[ribrob]

I seem to get a lot of spam from China and Israel too, what are the character sets i need to be filtering for to catch those?

[Sherry]

Originally Posted by ribrob

I seem to get a lot of spam from China and Israel too, what are the character sets i need to be filtering for to catch those?

Hi ribrob,

Wouldn't Bill's earlier post here work for you? If yes then I would definitely use his File Into Folders rule to be sure it wasn't catching something other than the spam... (also might want to read down through the responses and other post examples for his rule)

Sherry

Edit: unless I'm misunderstanding your question?

[kurianja]

Originally Posted by ribrob

I seem to get a lot of spam from China and Israel too, what are the character sets i need to be filtering for to catch those?

I would suggest you check the headers of the email to find the undesirable charsets, and then create a filter to catch them. Make sure you don't get legitimate emails in those charsets, or you will end up losing them. Or just create a 'file into folder' rule to move the emails to a designated folder, and then review the folder for a couple of weeks to make sure the filter is working correctly, and then create a discard rule...