[EMAIL PROTECTED] wrote: > > We're suddenly getting a ton of spam with koi8-r encoding...I tried to > do a custom rule for it like this: > > header SUBJ_RUSS_CHAR Subject =~/koi8-r/i > describe SUBJ_RUSS_CHAR has Russian char encoding > score SUBJ_RUSS_CHAR 3.5 > > The short headers for these spams look like this: > > Subject: [koi8-r] ??? ???? > > The "raw" Subject header, like this: > > Subject: =?koi8-r?B?9/zkINDSxcTQ0snR1MnKINPFzcnOwdI=?= > > I would think the rule would catch it either way...what am I missing?
I think this should work: header SUBJ_RUSS_CHAR Subject:raw =~ /koi8-r/i /Per Jessen, Zürich
