[Last modified: 20-MAY-2003]

The Weekly Spam Report



What I do about spam

My e-mail software has a set of filtering rules that, ideally, will send all spam to a separate folder, where it does not mix with normal messages and can be safely handled later. I created these rules from my own experience, and at the momment they catch aproximately 95% of all the spam I receive. They are adjusted to my conditions, and to the type of spam I receive, so they may or may not apply to you. You're welcome to use any or all of them, but do so at your own risk.

How does it work: first, messages addressed to all mailing lists I subscribe to are filtered to their own folders. Then, messages from known persons (or domains, in case of my work mailbox) go to the regular inbox. After that, all the rules below are applied, and divert all the supposed spam to a mailbox called "Spam", which my e-mail software is instructed to ignore (it won't tell me about the arrival of new messages if they go into that folder).

Here are the rules; a message will be considered spam if it matches any of these conditions:

At work:

  • "From:" does not contain '@'
  • neither "To:" nor "Cc:" contains "wilson" (my username)
  • "X-Mailer:" contains any of "Blastoise", "MailWorkZ" or "Mail Bomber"
  • any "Received:" line contains "dsl.telesp.net.br"
  • any "Received:" line contains "customer.telesp.net.br"
  • any "Received:" line contains "ajato.com.br"
  • "From:", "Sender:" or "X-Sender:" contains "bingo"
  • "From:" contains any of the following:
    • hype
    • bcentral.com
    • flashmail.com
    • powerfulporn.com
    • oab-sc.org.br
    • indiatimes.com
    • cuttingedgeoffers.com
    • brazendimentos
    • thevegasstrip.net
    • vegaslobby.com
    • brightmail.com
    • infomagic.com.br
    • vegaslist.com
    • @sf.com.br
    • yourip21.com
    • fastmarketing.com.br
    • omanmail.com
    • sarkisbrazil.com.br
    • blendmarketing.com
    • voceonline.net
    • redenvelopegifts.com
    • titty-mail.com
    • streamray.com
    • convite.com.br
    • @ure.com
    • shop-spmarket.com.br
    • @kerugma.com.br
    • CrownImperial.com
    • unreal-sex.com
    • etapafinal.com.br
    • marketing2002.com.br
    • paz.com.br
    • shopoeste
    • xxxletter.com
    • leti.com.br
    • ibest.com.br
  • "Subject:" contains any of the following:
    • "MEPPS"
    • "Muthu"
    • "adlt:adv"
    • "INKJET"
    • "adv:adlt"
    • "Wanna"
    • "NORTON SYSTEMWORKS"
    • "Free Porn"
  • the body of the message contains any of the following:
    • "unsub.cgi"
    • "U N I V E R S I T Y"
  • and this rules will send the message directly to the trash:
    • "From:" contains "hahaha@sexyfun.net"
    • "Subject:" contains "ScanMail for Lotus Notes"
    • body contains "I send you this file in order to have your advice"

At home:

  • "From:" does not contain "."
  • "To:" does not contain one of the addresses pointing to my mailbox
  • "Content-Type:" contains "GB2312"
  • "X-Mailer:" contains "Flicks"
  • any "Received:" line contains "[64.14." or "[66.240."
  • "From:" contains any of the following:
    • public.com
    • aol.com
    • hotmail.com
    • listenvoy.net
    • solishumanae.com.br
    • china.com
    • vsnl.net.in
    • consumervenue.com
    • adultcontentheaven.com
    • verticalresponse.com
    • oin60.com
    • myroyaltymail.com
    • link2buy.com
    • targetedemailnetwork.com
    • top-special-offers.com
    • imailgolf.com
    • funfabdeals.com
    • mm23.com
    • sina.com
    • mb00.net
    • cn99.com
    • rbmailsource.com
    • 1sourcedeals.com
    • myfreerewards.com
    • stationsnetwork.com
    • time-2-win.com
    • 2p.net
    • centerfoldgames.com
    • migada.com
    • regtoday.com
    • thatscricket.com
    • email-publisher.com
    • insightbb.com
    • marketingresearchinternational.com
    • evaluemail.com
    • hi-speedmediaoffers.com
    • hispeedmediaoffers.net
    • torpedomail.com
    • tesmailpromo.com
    • titbusters
    • prodemp.com.br
    • excitemasters.com
    • peter4537.com
    • titty-mail.com
    • nasty-mailings.com
    • ucumseeme.com
    • play4keeps.com
    • emailpink.com
    • opti7.com
    • hi-speedemail.com
    • curriculo.rh
    • specialfunoffers.com
    • regtoday1.net
    • promovalue.com
    • cruelgirl.net
    • virtual0.net
    • lolita
    • sheerdesire.com
  • "To:" contains "Muthu"
  • "Subject:" contains any of the following:
    • "RENDA EXTRA"
    • "Free PDA!"
    • "cable" and "descrambler" in any order
    • "Attract more women"
    • "Printer Cartridges"
    • "Cartucho de Tinta"
    • "lolita"
  • the body of the message contains any of the following:
    • "photoinks.com"
    • "You are receiving this message because"
    • "66.240.190.10"
    • "this is not spam"
    • "email blaster"

These rules are constantly receiving additions, I'll try to keep this page updated. In both sets of rules above, the most effective rules are the ones that filter messages where the addressee is not me (remember, these rules are applied after messages to mailing-lists are processed). They are also the ones that generate more false positives, due to people adding my address as a Bcc; this is the main reason why I have to sift through the spam folder before removing the messages. However, adding known addresses to my list is slowly reducing the number of false positives.


Last updated May 20, 2003. Send feedback, comments and criticism to Wilson Afonso.
Developed with jEdit