russian spam tsunami?

[Mark Nienberg]

Mark Sapiro wrote:
> On Tue, Mar 17, 2009 at 10:23:45AM -0700, Mark Nienberg wrote:
>   
>> Jeff A. Earickson wrote:
>>     
>>> Gang,
>>>
>>> Has anybody else been getting buried by Cyrillic spam?  We have
>>> been clobbered by it.  A big boatload comes from ttnet.net.tr,
>>> aka Turktelekom -- I blocked every IP netblock of theirs that I
>>> could find this weekend.  But it comes from lots of other places
>>> too.  Suggestions, eg SA rules?
>>>
>>> Jeff Earickson
>>> Colby College
>>>       
>> # One of those strange cyrillic fonts
>> header   LOCAL_CYRILLIC           Subject:raw =~ /windows\-1251/i
>> describe LOCAL_CYRILLIC           Cyrillic fonts
>> score    LOCAL_CYRILLIC           4
>>
>>
>> You can do the same with other character sets.
>>     
>
>
> Or you can find
>
> # =============== OK Locales ===============
>
> # ok_locales            en
>
> in /etc/MailScanner/spam.assassin.prefs.conf and uncomment the ok_locales
> line to accept only messages with western character sets.
>
>   
That helps too.  I have that line uncommented but I still get some 
messages that are in cyrillic fonts and don't trigger the 
CHARSET_FARAWAY set of rules for some reason. 

Mark Nienberg