Filter Russian spam

[yacup]

Hi,
I have been receiving a lot of spam in Russian lately. I tried to set up a filter in cpanel that would look for some of the Cyrillic characters but it doesn't work. The problem seems to be with encoding - every Cyrilic character is replaced by its numeric reference (e.g. и -> и ).
Does anybody know how to setup such filter?
Thank you.

[kobra]

You could deny full blocks of ru Ip's

[yacup]

The problem is, that the emails are not coming exclusively from ru IP's. They are from many different places:

c911100d.virtua.com.br ([201.17.16.13])                 
78-58-183-41.ip.zebra.lt ([78.58.183.41])
68-189-45-245.dhcp.rdng.ca.charter.com ([68.189.45.245])
mm-94-195-57-86.dynamic.pppoe.mgts.by ([86.57.195.94])  
201-254-48-42.speedy.com.ar ([201.254.48.42])           
27.sbhouston.com ([216.49.222.27])                      
248-78-246-201.adsl.terra.cl ([201.246.78.248])
...

The easiest way seems to be to filter all emails with Cyrillic characters, but I don't know how to set it up. If it's not possible on the server side, is there a Thunderbird extension that could do it?

[DiverseHosting]

Boxtrapper works for me!

[lanbytes]

Originally Posted by yacup

Hi,
I have been receiving a lot of spam in Russian lately. I tried to set up a filter in cpanel that would look for some of the Cyrillic characters but it doesn't work. The problem seems to be with encoding - every Cyrilic character is replaced by its numeric reference (e.g. и -> и ).
Does anybody know how to setup such filter?
Thank you.

SpamAssassin is your friend. Have a look at the Language Options at http://spamassassin.apache.org/full/...ssin_Conf.html

[yacup]

Thanks for the tip about Spam Assassin. I do use it for my email, but unfortunately it is not possible to configure it like that in the cpanel.
What I found out though, is that most of these messages use the same charset:

Content-Type: text/plain; charset=koi8-r

In cpanel I have created a simple filter that throws away all emails with headers containing that charset. Now I have to wait and see if it works.
Thanks guys.

[lanbytes]

Glad you nailed it. To clarify, cPanel exposes only a small subset of SpamAssassin options. You can set user configurable options, including language, in /.spamassassin/user_prefs