Nine strategies that have defeated spammers

On this page, I give you information about the way I have filtered out most of the spam from my mailbox. You are free to use my experience to develop your own anti-spam strategy. I am not willing to enter into correspondence about these strategies. If you can use the information below as is, then you are welcome to do so. If you can't, then you can always consider learning how to (but not from me, I don't have time).

It's important for you to understand that I don't just mean that I've stopped deleted the spam before it gets to me - in fact, because of the steps I have taken, spammers have actually stopped sending it.

Now, please note that I am using a broad-brush approach in the notes that follow. If I give every little detail, then some spammer, somewhere will cotton on to what I am doing, and will work around it. I don't want that, so I am not giving every little detail here. Now, I am a professional analyst/programmer. I know how to write programs. I am writing primarily for people who can also write programs. The fact that I haven't given every last detail won't matter to such folk - the last details may well vary in any case, depending on how they choose to implement the solution.

Strategy 1: Blocking known spam domains.

This does not require much explanation - some ISP's do so little to stop spammers that they may as well be spammers themselves. Once you know which they are, just block them.

Strategy 2: Don't post your email address anywhere unless you actually want spam, or have taken some other steps accordingly

Spammers harvest email addresses from web pages and any other place you write them down. There are ways to put your email address on a page so that it can't be harvested - the easiest way is to use a graphic image of some text that spells out the address, rather than using text itself. If you must post your email address somewhere public, then get another email address that can be protected against spam in some other way (see strategy 9 below for an example.

Strategy 3: Filter email based on content

Using MS Outlook, one can write macros to process the emails as they are received. I developed several routines that did this, and learned as they went, building up a log of how many times they had seen each word, and whether the context in which the word appeared was spam or legitimate.  Here's an extract from my logs. The first column shows two numbers followed by a word (or more accurately, a set of characters). The first figure shows how many times that word has been seen in a spam context, and the second shows how many times it has been seen in a legitimate context. The second column shows what percentage of occurrences were spam occurrences. (This is a stretched percentage scale, which runs from -100 to +100%, rather than 0 to 100, the formula is just (s-l)/(s+l)*100%

So, this table tells you that I have seen spams (before I started bouncing them!) that contained the combination "&#" a total of 5067 times, always in a spam context - those would be foreign language spams using double-byte character sets. Similarly, a dollar sign is a very good indicator of spam, since it isn't the currency in my country. Only 8 times has it been in legitimate emails, whereas 1167 times it was in spams.

You'll note a few, a very few, words, get red numbers in column 2. Those are the rare cases when a word is more common in legitimate emails than spams - one of these, naturally enough, is my name, which friends know, and spammers don't know. (Though it is also the name of other people who are victims of the same spam as me, which is why it gets 66 spam hits).

My method is simple - look at every word in an incoming mail. Work out the percentage figure for it. Discard anything between -75% and +75%. That just leaves the words that are almost always spam words or almost always legitimate words. Then just count them up, and calculate if it is a spam or a legitimate email.

In my scheme, when I am analysing the emails, I disregard numbers and convert any accented characters to their non-accented equivalents, to frustrate spammers who think it is ¢lëvé® to change such characters. I also discount most punctuation characters. I also count the frequency of comments compared to the frequency of words, to catch out those spammers who put comments in the middle of words to try to fox pattern matching. At the end, it all evaluates to a spam weighting. On my system, legitimate emails tend to get spam weightings from zero to about 50. Spam messages get weightings from 100 upwards - the worst one I ever got was a 3-pager that ended up rated at 4823!

Strategy 4: Filter emails based on routing 

Plenty of spammers use email servers in places like Russia, Argentina, China, Brazil and so on. I just don't know anybody in these places , so why should I get email from them? Obvious, when you think about it!

Strategy 5: Filter emails based on other people in the distribution list 

This only works with those spammers who are too greedy to send out messages addressed to only one person. (Fortunately, that's most of them!). This is also obvious, when you think about it. Most people sending legitimate emails send them either to one person or to a groups of people who tend to know each other. For any message that comes to me, I check the other names in the "to" and "cc" lists. If there are lots of names, and I don't have any of them in my address book, then it's a spam.

Strategy 6: Filter emails that contain hypertext links 

I discourage html emails anyway, but one dead giveaway that an email is a spam is if it includes a link, but the text of the link does not match the target of the link. Friends sometimes send emails with links in, but in those, the text always matches the target.

Strategy 7: Filter emails that contain scripts 

No friend of mine has ever sent me an email containing scripting language. Plenty of spammers have.

Strategy 8: Send a bounce message back to the originator of any spam 

If the person who sends you spam gets a bounce message to say that your address does not exist, then they will delete you from their circulation list. The more spams they have been sending you, the quicker this will happen. My most persistent spammers all stopped inside a fortnight! Of course, not every spammer checks for bounces. But those that don't are unlikely to be running a cost-effective operation anyway, so they tend to be short-lived annoyances. Warning: a bounce message is not the same as an email asking to be removed. You should never send those. Never, not ever, no way, no how.

Strategy 9: how to use a Hotmail inbox for (almost) a spam-free experience

a) Decide on a magic word. (My magic word is squirrel - make yours something else) Then publish your hotmail address, but tell people to put your magic word in the subject line of any email they send you.

b) Set up 3 hotmail filters.

    -    if the subject line contains <magic word> deliver mail to inbox

    -    if the from contains "@" delete email

    -    if the from does not contain "@" delete email

End result, all messages containing your magic word are delivered into your inbox. Everything else is deleted as soon as it arrives. The only spam you see is spam that happens to include your magic word in the subject - so, here's a tip: "viagra" and "money" would not be good magic words.

Remember - the spammers just want to get you to part with money. The more you can do to make their operation less cost-effective, the sooner they will go broke.

Have fun, and happy spam-hunting!

This page is a part of Chris Tolley's web-site.                                             Latest update: Tuesday, June 10, 2003 03:48
Links on my pages can point to other web-sites. If you find that the administrators of those web-sites have made changes which mean you can't access them, please let me know, so I can update or remove the links. As far as I know, none of my links point to sites likely to contain offensive material - but if you discover otherwise, please let me know, as I would like to remove such links from my pages.
return to my home page.	Frequently asked Questions	send me an e-mail
©1996 to 2003: Christopher J. Tolley