Comments on: Need help squashing foreign spam

Question: Need help squashing foreign spam

mathowie — Thu, 21 Sep 2006 08:12:41 -0800

I get tons of spam in languages other than english -- entire messages in other languages that I can't even read to determine what the spam is about. I'd like to make a simple set of email filters to whack out any email in russian, chinese, japanese, and korean. Can someone give me a single character from each language that represents the most commonly used letter? (like the letter "a" in English)

People I know never seem to send me stuff with other languages in it, so even if I go with the sledgehammer of looking for single popular characters, I don't think I'll get too many false positives.

Or should I try using language message headers instead? Do spammers stick to language-specific character sets?

By: krautland

krautland — Thu, 21 Sep 2006 08:19:06 -0800

throw a sample paragraph in here or into a translation site such as babelfish.

I'm getting tons of japanese spam myself.

By: kindall

kindall — Thu, 21 Sep 2006 08:27:59 -0800

I'd block using the content-type header. If you have control over your mail server, you can also just use country-specific blacklists and block entire countries. This is the approach I use; the bounce message includes instructions for getting whitelisted in case I unintentionally bounce any human correspondents. In the last year or so, exactly zero senders in Asia have added themselves to my whitelist.

By: sonofslim

sonofslim — Thu, 21 Sep 2006 08:28:56 -0800

i thought the letter 'e' was the most commonly used letter in english?

By: majick

majick — Thu, 21 Sep 2006 08:34:08 -0800

It's perhaps a bit of a big hammer to apply, but I've found that filtering messages having any non-ASCII character (or any Base64 escaped character) in the Subject: header pretty much clobbers all of the non-ASCII spam.

I used to do this with a regular expression in Procmail, but SpamAssassin has long supported language filtering, so I no longer have a convenient filter expression to paste for you. Sorry.

By: majick

majick — Thu, 21 Sep 2006 08:37:13 -0800

(Or any MIME-escaped character, for that matter /=\d\d/ appearing in the Subject: header matches a certain chunk of my non-ASCII spam)

By: Eater

Eater — Thu, 21 Sep 2006 08:48:11 -0800

Here is an archived version of a now-gone page that addresses this issue for Procmail users.

Here's a simpler filter recipe based on it, which I found somewhere long ago:



:0 BD

* -1^1 .

*  2^1 =[0-9A-F][0-9A-F]

* 33^1 [¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿]

* 33^1 [ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞß]

* 33^1 [àáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ]

* 33^1 =[A-F][0-9A-F]

| formail -i "Subject:[Asian character set]"

(not sure how well that'll appear in y'all's browsers)

By: Loto

Loto — Thu, 21 Sep 2006 08:51:29 -0800

SpamAssassin has an option like this.

By: krautland

krautland — Thu, 21 Sep 2006 08:52:27 -0800

eater, it looks here as if you are blocking a bunch of german and danish characters as well...

By: jdroth

jdroth — Thu, 21 Sep 2006 08:56:05 -0800

I've always wondered why ISPs can't handle this. My mailserver is hosted by Dreamhost. I want an option in their control panel that will allow me to block all e-mail with non-Western character sests, and it frustrates me that none exists. It seems that this simple act (along with blocking of image-only e-mails) would cut 50% of the spam I receive.

By: jellicle

jellicle — Thu, 21 Sep 2006 08:59:01 -0800

Previously asked. :)

I still think my answer is good: look for gb2312, koi8-r, big5, and so on in the Content-Type header of your email. This works extremely well, is easy, and has zero false positives.

By: Eater

Eater — Thu, 21 Sep 2006 09:03:58 -0800

Yeah, the pasting of the recipe above misrendered the high-bit characters.

By: blindcarboncopy

blindcarboncopy — Thu, 21 Sep 2006 09:24:22 -0800

Just use Outlook 2003 or higher :) It lets you allow/block messages by language.

By: mathowie

mathowie — Thu, 21 Sep 2006 09:59:40 -0800

jellicle, this is for gmail, so I think I can still do that by searching the header for those phrases.

By: stavrosthewonderchicken

stavrosthewonderchicken — Thu, 21 Sep 2006 16:54:19 -0800

This is the nearest phonetic equivalent to 'a' in Korean : ㅏ

By: jessicapierce

jessicapierce — Fri, 22 Sep 2006 08:54:25 -0800

I use gmail, have the same problem, and have been able to block most non-English spam by creating single-character filters. I did this by scanning the text of the spam and trying to find characters which appeared more than once. Sometimes this worked and sometimes it didn't, but when I couldn't find a duplicate, I chose a random character & created a filter for that. This isn't a perfect system and doesn't always work on the first try, but it definitely helped cut down on spam, right away.