We're suddenly getting a ton of spam with koi8-r encoding...I tried to do
a custom rule for it like this:

header SUBJ_RUSS_CHAR Subject =~/koi8-r/i
describe SUBJ_RUSS_CHAR has Russian char encoding
score SUBJ_RUSS_CHAR 3.5

The short headers for these spams look like this:

Subject: [koi8-r] ??? ????

The "raw" Subject header, like this:

Subject: =?koi8-r?B?9/zkINDSxcTQ0snR1MnKINPFzcnOwdI=?=

I would think the rule would catch it either way...what am I missing?


James Smallacombe PlantageNet, Inc. CEO and Janitor
up@3.am http://3.am
================================================== =======================