Getting rid of Cyrillic spam

March 5, 2008

My spam filtering has gotten pretty good the past few years, largely due to doing a lot of work at improving the spam and virus filtering techniques we use on our mail servers. Some still gets through, however.

Some always gets through.

I’ve noticed for awhile now that of the spam that IS getting through, the vast majority of it was in Cyrillic — you know, the alphabet used by Slavic languages such as Russian, with the characters that tend to look a little backwards and odd to those of us only used to European alphabets.

After complaining about it briefly in Twitter, I received a brilliant suggestion from another user who said they filter their Gmail on that funny little “backward N”.


A few minutes with my rules, and I had a rule that is deleting around 85% of my remaining spam.

The example above is OS X’s, but you can do something similar with the message rules in virtually any email client.

A couple of tips:

  • Obviously, if you have email you want to receive that’s written in Cyrillic, this isn’t for you. I can’t read it, so I’m not going to miss anything by deleting it.
  • Add the Cyrillic characters by copying and pasting them from some of your spam.
  • The first rule got the vast majority of my spam. The second and third rules (subject and from) picked up a few remaining messages that only had an image in the message body.
  • This left a small handful of remaining messages which didn’t have the first character in them. I picked a second character that seemed to be common in these messages, and duplicated the first three rules with that character.

That’s all there is to it — simple, easy, and it got rid of most of my “leak through” spam.

At least until the spammers come up with something else new… (sigh)

(Tip of the hat to Annie Boccio for twittering this great idea!)

Be Sociable, Share!


One Response to “Getting rid of Cyrillic spam”

  1. rimone on March 12th, 2008 10:56 am

    oh, WOW. THANK YOU, Chuck. and i’m sorry i’m all shouty but after reluctantly turning on Spam Assassin last week and seeing the dif in my incoming, i’ve come to despise this shit w/a passion. gonna do this ASAP and i’m sure it’ll reduce the waste. thanks again.

Got something to say? [privacy policy]

You must be logged in to post a comment.