how to detect koi8-r characters

Kevin Howard kevin.howard at
Mon Sep 15 12:28:12 IST 2008

We're receiving a lot of spam comprising Cyrillic characters in the subject line, example Subject: =?koi8-r?B?8sXLzGHNwSDXIOnObcXSzsVtxSA=?=
and a message body which is 100% Cyrillic, some messages are plain text and some HTML. 
The plains messages are using;
MIME-Version: 1.0
Content-Type: text/plain;
Content-Transfer-Encoding: 8bit

Spamassassin doesn't seem to be able to detect these reliably despite us training bayes on these messages and utilising language filters. So we're trying to use MCP to detect them but have had no success whatsoever to date.
I have tried making a rule to detect " ?koi8 " in the subject line but Mailscanner only seems to look at visible characters.
Any ideas?  my preference is to stop them with MCP if possible.
-------------- next part --------------
An HTML attachment was scrubbed...

More information about the MailScanner mailing list