FAQ: Asian spam

[Tony L. Svanstrom]

On Fri, 28 Mar 2003 the voices made Boris 'pi' Piwinger write:

BpP> "Boris 'pi' Piwinger" <3.14 at logic.univie.ac.at> wrote:
BpP>
BpP> >> ## Silently drop all completely unreadable spam
BpP> >> :0
BpP> >> * 1^0 ^\/Subject:.*=\?(.*big5|iso-2022-jp|ISO-2022-KR|euc-kr|gb2312|ks_c_5601-1987|windows-1251|windows-1256)\?
BpP> >> * 1^0 ^Content-Type:.*charset="?(.*big5|iso-2022-jp|ISO-2022-KR|euc-kr|gb2312|ks_c_5601-1987|windows-1251|windows-1256)
BpP> >> /dev/null
BpP> >
BpP> >This fails on multipart, but the fix is too risky I think.
BpP>
BpP> Tony L. Svanstrom <tony at svanstrom.com> could not post to a
BpP> list. But he has some recipe that works. Here it is (remove
BpP> quotes):

 I've finally unsubscribed and subscribed with the address in the env-to...
yay... it only took a cpl of weeks. =/

BpP> >:0
BpP> >* ^Content-Type:[  ]*multipart/.*;[  ]*boundary="\/[^"]+
BpP> >        {
BpP> >        :0B
BpP> >        * $ ^--$\MATCH^Content-Type:[  ]*multipart/.*;^?[  ]*boundary=\"\/.+[^\"]
BpP> >                {  }
BpP> >        :0Bfw
BpP> >        * $ ^--$\MATCH^Content-Type:.*^?[  ]*charset[=:\"]*(CharsetA|CharsetB|CharsetEtc)
BpP> >                | formail -A "x-svanstrom.com: Blacklisted: Charset in MIME!"
BpP> >        }

 It is a lil bit ugly looking, but it's what I ended up with that caught the
most spam (as defined by the charset in MIME-parts); the multipart-in-multipart
doesn't seem to be very common, but I do get enough of it to warrant the extra
body-recipe.

-- 
      /\___/\                                              /\___/\
      \_@ @_/                                              \_@ @_/
 +--oOO-(_)-OOo------------------------------------------oOO-(_)-OOo--+
 | Per scientiam ad libertatem! // Through knowledge towards freedom! |
 +---ôôô---ôôô--------------------------------------------ôôô---ôôô---+
     \O/   \O/      (c)1998-2003  tony at svanstrom.com      \O/   \O/