Re: Crisis on the Russian Front! Endless Cyrillic Spam...

Tech-Archive recommends: Speed Up your PC by fixing your registry

From: Bob Greenblatt (me_at_somewhere.com)
Date: 06/30/04 

Date: Wed, 30 Jun 2004 17:08:54 -0400

On 6/30/04 10:31 AM, in article BD088D5E.1B68C%barry@mvps.org.INVALID,
"Barry Wainwright" <barry@mvps.org.INVALID> wrote:

> On 30/6/04 12:08 pm, in article
> bunnyslippers-6A19FE.07082130062004@news.newsguy.com, "Sammy"
> <bunnyslippers@flophouse.edu> wrote:
>
>> In article <BD074A6F.1B452%barry@mvps.org.INVALID>,
>> Barry Wainwright <barry@mvps.org.INVALID> wrote:
>>
>>> On 29/6/04 3:38 pm, in article
>>> bunnyslippers-0BD3E6.10380829062004@news.newsguy.com, "Sammy"
>>> <bunnyslippers@flophouse.edu> wrote:
>>>
>>>> I'm still having difficulties here. Perhaps I'm not working the Rules
>>>> correctly - it seemed so easy in Apple's Mail program.
>>>>
>>>> The bulk of what I'm getting comes from seznam.cz . I've made
>>>> several different variants of that seznam.cz> , @seznam.cz , and had
>>>> the instruction read "If From seznam.cz, change status to junk email".
>>>>
>>>> Is there anything glaringly obvious that I should be doing?
>>>>
>>>> Thanks,
>>>>
>>>> Sammy
>>>
>>> 1. I presume that reads if 'from' <contains> 'seznam.cz', not if 'from <is>
>>> 'seznam.cz'?
>>>
>>> 2. Post the headers of one of the messages here and we may be able to give
>>> you some pointers.
>>
>>
>> Thanks for your patience, Barry.
>>
>> Here's the header of one of the ceznam emails I got today:
>>
>> Received: from mail1.panix.com (mail1.panix.com [166.84.1.72])
>> by echonyc.com (8.12.11/8.12.11) with ESMTP id i5UAQopn016355
>> for <jaze@echonyc.com>; Wed, 30 Jun 2004 06:26:50 -0400 (EDT)
>> Received: from 218.191.73.150 (unknown [218.191.73.150])
>> by mail1.panix.com (Postfix) with SMTP id 32CDC4872A
>> for <jaze@echonyc.com>; Wed, 30 Jun 2004 06:26:46 -0400 (EDT)
>> Date: Wed, 30 Jun 2004 10:23:58 +0000
>> From: huasheng <jiseong@seznam.cz>
>> To: jaze@echonyc.com
>> Subject: =?Windows-1251?B?5O7s4Pjt6OUg6+Xq4PDo?=
>> MIME-Version: 1.0
>> Content-Type: multipart/related;
>> boundary="----------B50202D1701B4C18296099906"
>> Message-Id: <20040630102646.32CDC4872A@mail1.panix.com>
>> Content-Length: 5571
>> Status:
>>
>>
>> Any suggestions?
>>
>> THANKS!
>
> OK, 1 step further...
>
> I see that the subject is encoded in windows-1251, which is either Russian
> or Macedonian character set.
>
> I'm not sure there is any way to test the encoding of the subject line - you
> could try 'subject contains "windows-1251", but I think that's an outside
> chance.
>
> The message itself is labelled as 'multi-part/related', indicating that
> there is likely to be an HTML part and an alternative plain text part.
> Unfortunately, your headers didn't post the content type header for either
> of these parts! They are likely to be 1251 as well, but could, in theory, be
> different.
>
> Look at those headers for the encoding set, and then set up a filter to look
> for 'any header' contains 'windows-1251' (or whatever the relevant encoding
> scheme is).
I've been following this with interest, as I have the same problem. I have a
rule that says "any header contains 1251", but that does not work either. 

-- 
Bob Greenblatt [MVP], Macintosh
bobgreenblattATmsnDOTcom

Relevant Pages