Dear all,
I accidently posted this message to dovecot-news and want to apologize
for any trouble I may have caused. Here it is again to the correct
mailing list:
Recently I'm getting a ton of porn/viagra/diet/casino spam mails which I
tried to filter with sieve:
if header :contains "Subject" [ "[SPAM]",
"Bett",
"Schlafzimmer",
"Spielen",
"Luder",
"abhenmen",
"poppen",
"Casino",
"Bonus",
"abnehmen",
"Gewinn",
"Potenz" ] {
addflag "\\seen";
fileinto "Spam";
stop;
}
Sadly, this didn't work - taking a closer look upon one of the spam
mails, it seems the spamming rats have encoded the subject:
Subject: =?US-ASCII?B?RW5kbGljaCBtZWhyIGVuZ2FnZW1lbnQgaW0gQmV0dGNoZW4=?(reads:
"Endlich mehr engagement im Bettchen")
I'm thinking about filtering all such encoded subjects (as there's no
reason to encode them US-ASCII), but suppose it were UTF-8 or something:
how can I filter on the actual content, not the encoded subject? Surely
someone has solved that problem already?
Kind regards,
Johannes
On Thu, 2009-12-10 at 19:34 +0100, Johannes Bauer wrote:> Dear all, > > I accidently posted this message to dovecot-news and want to apologize > for any trouble I may have caused.Don't worry. All mails there from non-trusted addresses simply get discarded (or rejected?)> Sadly, this didn't work - taking a closer look upon one of the spam > mails, it seems the spamming rats have encoded the subject: > > Subject: =?US-ASCII?B?RW5kbGljaCBtZWhyIGVuZ2FnZW1lbnQgaW0gQmV0dGNoZW4=?> (reads: "Endlich mehr engagement im Bettchen")They're decoded at least in v1.2 with the new Sieve plugin. I don't remember if CMU Sieve decoded them, I'm guessing not. So maybe it's time for an upgrade? -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 197 bytes Desc: This is a digitally signed message part URL: <http://dovecot.org/pipermail/dovecot/attachments/20091210/5daac917/attachment-0002.bin>
On Qui, 10 Dez 2009, Johannes Bauer wrote:> I'm thinking about filtering all such encoded subjects (as there's no > reason to encode them US-ASCII), but suppose it were UTF-8 or something: > how can I filter on the actual content, not the encoded subject? Surely > someone has solved that problem already?Yes, such as the guys behind SpamAssassin, or dspam, or any of the many spam filtering programs that exist. Actually, they make much more complicated decisions instead of only looking for bad words in the subject field. I'd suggest you try installing one of them. -- Eduardo M KALINOWSKI eduardo at kalinowski.com.br
Timo Sirainen schrieb:> They're decoded at least in v1.2 with the new Sieve plugin. I don't > remember if CMU Sieve decoded them, I'm guessing not. So maybe it's time > for an upgrade?*sigh*, I guess it might be. brick [~]: dovecot --version 1.0.rc15 I'm still somewhat reluctant to change to 1.2, because that would mean that I cannot rely on my distros packages anymore (Etch that is for that server) but must maintain the packages myself. Well... Kind regards, Johannes