Comments on: Microsoft Exchange 2007: using Content Filter to fight Spam / Junk using Codepages http://www.christiano.ch/wordpress/2009/07/31/microsoft-exchange-2007-using-content-filter-to-fight-spam-junk-using-codepages/ christiano.ch blog - personal knowledge base, news, memoires et cetera Fri, 03 Feb 2012 17:13:33 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: Bill http://www.christiano.ch/wordpress/2009/07/31/microsoft-exchange-2007-using-content-filter-to-fight-spam-junk-using-codepages/comment-page-1/#comment-11334 Bill Tue, 24 May 2011 19:13:00 +0000 http://www.christiano.ch/wordpress/?p=117#comment-11334 This does not work. Adding koi8-r to the custom bad word list does absolutely nothing. That filter must only look in the subject and body, but not in the header. This does not work. Adding koi8-r to the custom bad word list does absolutely nothing. That filter must only look in the subject and body, but not in the header.

]]> By: christian http://www.christiano.ch/wordpress/2009/07/31/microsoft-exchange-2007-using-content-filter-to-fight-spam-junk-using-codepages/comment-page-1/#comment-17 christian Fri, 14 Aug 2009 13:09:00 +0000 http://www.christiano.ch/wordpress/?p=117#comment-17 Did you try adding the phrase charset=”koi8-r” To the content filter? Using Exchange Management Shell, as Admin you could use this cmdlet to add the string/phrase <em>koi8-r</em> to your Exchange Content Filter as a bad phrase => <strong>Add-ContentFilterPhrase -Influence BadWord -Phrase "koi8-r"</strong> Or use the Exchange Management Console, navigate to Edge Transport, double click Content Filtering Feature, switch to custom words and add koi8-r to the bad word list to block all mails with koi8-r codepage / charset. hope that help, otherwise let me know. Christian Did you try adding the phrase
charset=”koi8-r”
To the content filter?
Using Exchange Management Shell, as Admin you could use this cmdlet to add the string/phrase koi8-r to your Exchange Content Filter as a bad phrase => Add-ContentFilterPhrase -Influence BadWord -Phrase “koi8-r”
Or use the Exchange Management Console, navigate to Edge Transport, double click Content Filtering Feature, switch to custom words and add koi8-r to the bad word list to block all mails with koi8-r codepage / charset.
hope that help, otherwise let me know.
Christian

]]> By: Deepak Wanjale http://www.christiano.ch/wordpress/2009/07/31/microsoft-exchange-2007-using-content-filter-to-fight-spam-junk-using-codepages/comment-page-1/#comment-16 Deepak Wanjale Fri, 14 Aug 2009 12:40:06 +0000 http://www.christiano.ch/wordpress/?p=117#comment-16 We are using Exchnage 2007 with Forefront server , we have getting lots of SPAM mail from KOI8 , i have given the follwoing exampls , please help me out. Subject : Поиск заказов Message Body : Здравствуйте! Меня зовут Влад, я предлагаю сотрудничество. У нашей компании есть возможность поиска заказчиков для Вашего бизнеса. Если Вам это может быть интересно, пожалуйста свяжитесь со мной, предложу различные схемы: Телефон: ( Ч 9 5)5 8960 3 4 ICQ: 6 9 9099 Internet header : Received: from dsldevice.lan (59.101.1.137) by copuex01.coreobjects.com (192.168.11.18) with Microsoft SMTP Server id 8.1.240.5; Fri, 14 Aug 2009 16:04:40 +0530 Received: from 59.101.1.137 by mxs.mail.ru; Fri, 14 Aug 2009 20:34:25 +1000 From: Amalia Jaramillo To: Subject: =?koi8-r?B?8M/J08sg2sHLwdrP1w==?= Date: Fri, 14 Aug 2009 20:34:25 +1000 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="koi8-r" Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0) X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2663 Importance: Normal Return-Path: intrusivesx76@list.ru X-MS-Exchange-Organization-PRD: list.ru X-MS-Exchange-Organization-SenderIdResult: SoftFail Received-SPF: SoftFail (copuex01.coreobjects.com: domain of transitioning intrusivesx76@list.ru discourages use of 59.101.1.137 as permitted sender) X-MS-Exchange-Organization-SCL: 4 X-MS-Exchange-Organization-PCL: 2 X-MS-Exchange-Organization-Antispam-Report: DV:3.3.5705.600;SID:SenderIDStatus SoftFail;OrigIP:59.101.1.137 X-Auto-Response-Suppress: DR, OOF, AutoReply We are using Exchnage 2007 with Forefront server , we have getting lots of SPAM mail from KOI8 , i have given the follwoing exampls , please help me out.

Subject : Поиск заказов
Message Body : Здравствуйте!

Меня зовут Влад, я предлагаю сотрудничество.
У нашей компании есть возможность поиска заказчиков для Вашего бизнеса.

Если Вам это может быть интересно, пожалуйста свяжитесь со мной, предложу различные схемы:
Телефон: ( Ч 9 5)5 8960 3 4
ICQ: 6 9 9099

Internet header :

Received: from dsldevice.lan (59.101.1.137) by copuex01.coreobjects.com
(192.168.11.18) with Microsoft SMTP Server id 8.1.240.5; Fri, 14 Aug 2009
16:04:40 +0530
Received: from 59.101.1.137 by mxs.mail.ru; Fri, 14 Aug 2009 20:34:25 +1000
From: Amalia Jaramillo
To:
Subject: =?koi8-r?B?8M/J08sg2sHLwdrP1w==?=
Date: Fri, 14 Aug 2009 20:34:25 +1000
Message-ID:
MIME-Version: 1.0
Content-Type: text/plain; charset=”koi8-r”
Content-Transfer-Encoding: 8bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0)
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2663
Importance: Normal
Return-Path: intrusivesx76@list.ru
X-MS-Exchange-Organization-PRD: list.ru
X-MS-Exchange-Organization-SenderIdResult: SoftFail
Received-SPF: SoftFail (copuex01.coreobjects.com: domain of transitioning
intrusivesx76@list.ru discourages use of 59.101.1.137 as permitted sender)
X-MS-Exchange-Organization-SCL: 4
X-MS-Exchange-Organization-PCL: 2
X-MS-Exchange-Organization-Antispam-Report: DV:3.3.5705.600;SID:SenderIDStatus SoftFail;OrigIP:59.101.1.137
X-Auto-Response-Suppress: DR, OOF, AutoReply

]]>