On Thu, Apr 25, 2002 at 09:14:32AM +0100, Patrick Kirk wrote: > I have given up on using my .forward as a spam filter because I've now > gone up to over 40 spam pieces a day and its a pain to keep adding > conditions on each .forward on each account. > > Just to make clear, my particular desire to stop stuff from Korean and > Taiwan is that I speak neither Korean nor Chinese. > > > I wonder if anyone can help with these tests: > > 1. I am on numerous Korean spam lists. So I want to exclude all email > with Korean charsets. How do I set $h_Content-Type: contains > "ks_c_5601-1987" to score 20?
Something like this should do the job (although I just blackhole it in .procmailrc now because it's faster): header BROKEN_KOREAN_CHARSET Content-Type =~ /charset="?ks_c_5601-1987/ describe BROKEN_KOREAN_CHARSET I don't speak Korean score BROKEN_KOREAN_CHARSET 20 (I called it "BROKEN" because I understand real Koreans, as opposed to spammers, actually use a different character set - but I may be misinformed here.) > 2. I get a lot of stuff from Taiwan. Is it poossible to simply > blacklist all mail relayed from ISPs with .tw tld? You can probably match on Received: headers. Check /etc/spamassassin/20_head_tests.cf for examples. > 3. How can I blacklist specific names? For example, esavingszone send > me two messages every day and I want them automatically blocked. But > they use differing domain nemaes so I want to block > [EMAIL PROTECTED] [EMAIL PROTECTED] and every other > [EMAIL PROTECTED] 'blacklist_from [EMAIL PROTECTED]' in ~/.spamassassin/user_prefs, I think. > 4. The ISP that uses hanmail.net and daum.net is the single worst > offender. Can I block all mail relayed theough these domains? Again, you can probably do this by matching on Received: headers. -- Colin Watson [EMAIL PROTECTED] -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
