Hallo, in letzter Zeit bekomme ich SPAM mit Kyrillischem Zeichensatz. Beispiel: Return-Path: Received: from static.vdc.vn (222.253.30.207) by knecht (Axigen) with ESMTP id 169214; Wed, 13 Oct 2010 09:10:23 +0200 Received: from [181.166.2.177] (helo=cgyvzbiuqszju.ubywpxqmhg.net) by static.vdc.vn with esmtpa (Exim 4.69) (envelope-from ) id 1MM90X-9520va-81 for xxx@yyy.zz; Wed, 13 Oct 2010 14:10:23 +0700 From: =?koi8-r?B?IvPF0sXWwSD3xdPFzM/XIg==?= To: xxx@yyy.zz Subject: =?koi8-r?B?0NLFxNLFytPP19nKIM/Tz/U0iDOwSDXwdvFyiDUxdLSydTP0snJ?= Date: Wed, 13 Oct 2010 14:10:23 +0700 MIME-Version: 1.0 Content-Type: text/plain; charset="koi8-r" Content-Transfer-Encoding: 8bit X-Mailer: tdeuo_08 Message-ID: X-AxigenVirus-Level: 1 X-AxigenSpam-Level: 7 ���������� ������ ����������� ����� � �������������� ���������������� �� ���������� ������������ � ������������� �������� ��������� ������������ �������. ���������� �������� �������� ��� �� ���������� ���������, ��� � � ����������� ������ ������������� � ������� ����� "���������", "�����������" ���� ��� �������������� ���� �����������, �� ������ ��������� � ���� �� ��������:8-903-578-28-95 ��. �����: predreisosmotr@yandex.ru Skype: gureva_vlada Kann mir bitte jemand dabei helfen einen Filter dafür zu erstellen? Danke Gerd
-
-
AXIGEN bietet keine "1-Klick-Lösung" für dieses Problem. Möglich wäre:
a) der von Ihnen eingesetzte Spamfilter bietet eine solche Option?
b) Sperren der IP-Adressen aus Ostblock-Ländern:
Security & Filtering => Additional AntiSpam Methods => Country Filteringc) Filtern des Inhalts => Security & Filtering => Incoming Message Rules =>
Body => Contains => Hier könnte man versuchen, ein Kriterium, wie z.B.
charset="koi8-r" zu finden. -
-
Leider kann man die Regel kaum entziffern (zu klein). Am Besten das Processing-Log-Level einmal auf Maximum setzen und mitlesen, ob die Regeln ausgewertet werden.
-
Sorry,
hier die Inhalt beider Zeilen:
((?i)charset=("){0,1}.*((windows-1251)|(koi8-r)|(2022-jp)))
((?i)subject:.*koi8-r)Die Regel basiert auf Body Text.
Gerd
-
Aus meiner Sicht werden hier keine RegExps unterstützt - zumindest nicht über das Webadmin-Interface.
-
Ich kann nicht erkennen, ob überhaupt ein Filter gefragt wird:
Mein Filter trägt den Namen: russian-spam
Eingetragen hab ich den unter Security & Filtering => Incoming Message Rules =>
Body => Contains =>PROCESSING:000C8F12: Shepherd thread received signal for processing
PROCESSING:000C8F12: Start processing mail
PROCESSING:000C8F12: Start filter AV:AVG of type socket filter from server
PROCESSING:000C8F12: Shepherd thread finished processing signal
PROCESSING:000C8F12: << 220-AVG daemon mode scanner (AVG)
PROCESSING:000C8F12: << 220-Program version 8.5.855
PROCESSING:000C8F12: << 220-Virus Database: Version 271.1.1/3194 2010-10-13
PROCESSING:000C8F12: << 220 Ready
PROCESSING:000C8F12: >> SCAN
PROCESSING:000C8F12: >> /var/opt/axigen/queue/0C/D8F12.00
PROCESSING:000C8F12: << 200 ok
PROCESSING:000C8F12: Filter AVG AntiVirus Filter(127.0.0.1:55555):[PASS]: ok
PROCESSING:000C8F12: Finished filtering mail object 0C8F12 with filter: AV:AVG of type socket filter from server
PROCESSING:000C8F12: Start filter ClamAV-local of type socket filter from server
PROCESSING:000C8F12: >> SCAN
PROCESSING:000C8F12: >> /var/opt/axigen/queue/0C/D8F12.00
PROCESSING:000C8F12: << /var/opt/axigen/queue/0C/D8F12.00: OK
PROCESSING:000C8F12: Filter ClamAV(/var/run/clamav/clamd.ctl):[PASS]: OK
PROCESSING:000C8F12: Finished filtering mail object 0C8F12 with filter: ClamAV-local of type socket filter from server
PROCESSING:000C8F12: Start filter AV:SpamAssassinBundled of type socket filter from server
PROCESSING:000C8F12: >> CHECK SPAMC/1.2
PROCESSING:000C8F12: >> Content-length:
PROCESSING:000C8F12: >> 1098
PROCESSING:000C8F12: >>
PROCESSING:000C8F12: >> Send mail stream: 0C8F12
PROCESSING:000C8F12: << SPAMD/1.1 0 EX_OK
PROCESSING:000C8F12: << Spam: True ; 9.3 / 5.0
PROCESSING:000C8F12: Filter SpamAssassin Filter(127.0.0.1:1987):[MATCH(P)]: Spam: True ; 9.3 / 5.0
PROCESSING:000C8F12: Finished filtering mail object 0C8F12 with filter: AV:SpamAssassinBundled of type socket filter from server
PROCESSING:000C8F12: Start filter WASieveServer of type script filter from server
PROCESSING:000C8F12: Finished filtering mail object 0C8F12 with filter: WASieveServer of type script filter from server
PROCESSING:000C8F12: Start filter WASieveAccountDefault of type script filter from domain object <user@domain.tld>
PROCESSING:000C8F12: Finished filtering mail object 0C8F12 with filter: WASieveAccountDefault of type script filter from domain object <user@domain.tld>
PROCESSING:000C8F12: Start filter wmFilter of type script filter from domain object <user@domain.tld>
PROCESSING:000C8F12: Finished filtering mail object 0C8F12 with filter: wmFilter of type script filter from domain object <user@domain.tld>
PROCESSING:000C8F12: Finish processing mail
PROCESSING:000C8F12: Shepherd thread received signal for delivery
PROCESSING:000C8F12: Shepherd thread finished processing signal
PROCESSING:000C8F12: Start mail delivery
PROCESSING:000C8F12: Mail delivered to mailbox 'SPAM' of <user@domain.tld> with id 8256
PROCESSING:000C8F12: Shepherd thread received signal for cleanup
PROCESSING:000C8F12: Start mail cleanup
PROCESSING:000C8F12: Mail removed from queue
PROCESSING:000C8F12: Shepherd thread finished processing signal -
Ja, sie wurde durchlaufen:
PROCESSING:000C8F12: Start filter WASieveAccountDefault of type script filter from domain object <user@domain.tld>
PROCESSING:000C8F12: Finished filtering mail object 0C8F12 with filter: WASieveAccountDefault of type script filter from domain object <user@domain.tld>Die Filter sind Sieve-Filter und wenn die Regel unter den Account-Details der Domain domain.tld angelegt wurde, wurde sie geprüft.