[Mimedefang] Recipe Question

[listuser at neo.pittstate.edu]

On Sun, 27 Oct 2002, Jeff Grossman wrote:

> I noticed on the site
> http://www.roaringpenguin.com/mimedefang/canit/recipes.php3 there are a
> few example recipes.  I really like the following one:
> 
> $head = $entity->head;
> $charset = $head->mime_attr("content-type.charset");
> if (defined($charset)) {
>     $charset =~ tr/A-Z/a-z/;
>     if ($charset eq "ks_c_5601-1987" or
>         $charset eq "euc-kr") {
> 	return action_bounce("Spam from Korea not accepted.");
>     }
> }
> 
> Which is supposed to block all Korean e-mail.  Where would I put that
> recipe on my mimedefang filter?
> 
> Also, what would I use to block China e-mail?  And, where might I go to
> find the charset's for other languages?

Somebody correct me if I'm wrong but wouldn't this only stop mail
originating from a MUA on a Korean box?  Even though I've received a lot
of junk mail from Korea and other foreign countries in foreign languages,
by far the most mail I get from those same countries are open relay/proxy
spam.  This type of filter should do nothing to help that.

I'd recommend you look into country DNSBLs.  This is where SpamAssassin
comes in handy.  Scoring against one of those lookups will get both
Korean-MUA spam and spam from a relay-raped MTA in Korea.  There are a
couple country DNSBLs.  The one that I can think of off the top of my head
is at

http://www.blackholes.us/

What you can do with the DNSBL or the charset depends on your userbase. If
you're a Unv, you can probably only score it at maybe .75.  If your a
rural Kansas ISP, you can probably score it at 123456789.3 without much
fear of backlash, or the national debt if you know what it currently is.
:)

> p.s.  I don't know if it is just me, but in the past week I have been
> getting hit with a lot more spam than usual.  Is anybody else seeing
> this?

I'm up a bit too.  I'm still under my record which was set in July but it
did get pretty high this week.

Justin