Mark's Notebook

Spam correction

Correction: on average, a spam message that gets through to my computer has size about 800 bytes. Over the last five hours, the average spam message caught in the Spam Assassin filter had size about 6900 bytes.

The shorter messages are more likely to get through because there is less "there" to trigger the filters.

Eudora allows me to filter messages into separate mailboxes based on various criteria. I can filter a message directly into the trash if I think it is spam. Here's how I deal with spam:

• First, make sure I filter out all the mail I know is good. Emails from my wife, my friends, and mailing lists I'm subscribed to. Don't forget good commercial emails like Ebay or Amazon if you're a customer.

  Now, anything that's left is suspect.

• Filter out any message that has an attachment of type PIF, SCR, or ZIP. It's spam. Not only that, it's a virus. Get rid of it. Only my known friends would send me a ZIP file attachment. Those were filtered out in the first step.

• Filter out any message that has a link. Yeah, I know my own messages almost always have a link to my blog. But you've already filtered out my messages as a friend in the first step, right? RIGHT? GOOD! Anyway, the easiest way to find a link is to look for "html" or "http".

• There are words that are more commonly contained in spam emails I receive than in legitimate emails I receive. You might think they would be words like body parts or "Rolex." But no. the two most common words that spell SPAM to me are "free" and "best." Searching for the string "est " will also find variations like "fastest," "strongest," etc.

• Spam emails frequently have characters like []|*@#! in the subject of the email. Get rid of all those. Especially "!"

• Lots of spam comes from certain domains, actually certain countries. I get rid of anything from ZY (???), SE (Sweden), SG (Singapore), PT (Portugal), RU (Russia), NO (Norway), PL (Poland), MX (Mexico), NL (Netherlands), HU (Hungary), IT (Italy), ES (Spain), FR (France), CN (China), DE (Germany), AR (Argentina), and AU (Australia).

  You might know people from those countries. I don't, except Susie R from the Netherlands, and I filter her out as a friend in the first step.

  Don't forget that if you use a service like Ebay or Yahoo where you might buy things from someone in another country, you won't want to filter out their emails. So you must treat Ebay or Yahoo as a mailing list and filter those emails into the "good" pile.

• Lots of spam comes from certain IP blocks. I filter out anything from 61, 211, 217, and 218. It's all spam.

Articles

Last updated Monday 3 August 2009