Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: Cyrilic
From: Raoul Nakhmanson-Kulish <raoul () elforsoft com>
Date: Wed, 05 Oct 2005 10:37:23 +0400

Hello, Aditya Deshmukh!

At 05.10.2005 8:24 you wrote:

I have one user who keeps getting cyrilic spam, but I cant find a rule
Is anyone else getting this kind of spam??
Welcome to the club of cyrilic spam recipects, we have many existing members

The rule that you want to create is this

If the message body or header contains "Windows-1251"
Then ***** it

***** == delete it or file it or blacklist it whatever -

But doing this will cause all the mails from russia to be ******'ed and you
have good people like 3APA3A who will also be blocke that are on this list.
Competent Russians prefer KOI8-R encoding. You may ban all Windows-1251 messages whithout significant loss.

Raoul Nakhmanson-Kulish,
Elfor Soft Ltd.,
IT Department
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]