[Rspamd-Users] Block emails with Chinese and Cyrillic characters in the subject

[Andreas]

Hello Steve and Ged.,

thank you for your contributions; they're both helping me understand things 
further. I'll try Steve's suggestion in particular. Then we'll see if these 
emails are blocked.

Best regards

Andreas



> Here's what I do.
> 
> X_LOCAL_CONTENT_BL {
>     type = "content";
>     filter = "full";
>     map = "$LOCAL_CONFDIR/local.d/maps.d/blacklist/content.map";
>     description = "Local content blacklist.";
>     regexp = true;
>     score = 10000;
> }
> 
> 
> Here are the relevant regexps in
> $LOCAL_CONFDIR/local.d/maps.d/blacklist/content.map:
> 
> # Non-Western charsets
> #
> /(=\?|charset\=)big5/i                  # Big5
> /(=\?|charset\=)euc-kr/i                # Extended Unix Code -- Korean
> 
> /(=\?|charset\=)windows-1251/i          # Windows 1251
> /(=\?|charset\=)koi8-r/i                # Cyrillic
> /(=\?|charset\=)gb2312/i                # Chinese
> /(=\?|charset\=)ks_c_5601-1987/i        # Hangul (Korean)
> 
> 
> Big5 and gb2312 are traditional & simplified Chinese, respectively.  Here's
> the complete list:
> 
> https://www.lsoft.com/manuals/maestro/4.0/htmlhelp/data%20administrator/Char
> acterSets.html
> 
> Note that this DOES NOT block UTF-8...which can also contain Asian
> characters...so this method is not foolproof.  However, I don't get a lot
> of this so the above has worked for me for several years.
> 
> I use this map to block any kind of unwanted content.  For example:
> 
> /.*norton\s*(360)?.*/i                     # Mentions Norton (360)
> /.*m(a)?c\s*afee.*/i                       # Mentions McAfee
> /.*geek\s*squad.*/i                        # Mentions Geek Squad
> /.*m(icro)?((\-|\s)*)?s(oft)?\s*office.*/i # Mentions Microsoft Office
> /.*office\s*365.*/i                        # Mentions Office 365
> 
> 
> I hope this helps...
> 
> Regards,