mainsleazespam.com: Filtering Spam Email

Filtering Spam Email Issues

Opinions on various forms of filtering.

    There are many forms that filtering to block spam email can take. Even within the longterm active anti-spam community there is disagreement over the rationale, the techniques, and the consequences of differing blocking methods.

    The two main camps I see are:

    (1) Filtering all incoming email and blocking or quarantining it based on filtering on content, either on subject line, body text of the email, or if it has obfuscated HTML in the body.
    Some even block all HTML email on the assumption it is probably from a spammer. This is done by rejecting based on occurence of common words that appear in spam, such as "viagra", "penis", "XXX", and so on. Filters also act based on finding clearly obfuscated strings of characters in the title or body, as spammers now do this with increasing vehemence as they try to get their spam past increasingly effective filters, e.g. "Men (Eks-Eks-Eks) movie stars tips !! " to avoid filtering on "XXX". The more spam filters stop, the harder spammers obfuscate. Here is a sample of what I am seeing in what email inbox' quarantine in January, 2004:
        <Au=dullt male stars famous sized !
        .Aa, ddullt movie stars Ceecrut for fame !
    And how could one not fail to feel compelled to open offers in email with subject lines like this:
        Re: OUSH, no one knew << typo ajar pantheon shelve berkowitz comeback conjoint c

    I realized how bad filters can be designed when I saw a press release emailed to a subscription only mailing list from the Media Relations office where I am employed rejected by one ISP because the subject line included the word "free". As in "free throw". The email was a press release on the results of the previous night's basketball game!

    (2) Filtering all incoming email based on identified IP numbers or ranges of IP numbers, based on reports or experience of spam from IP numbers, or IP blocks of IPs at ISPs that appear not to take action against spam or spam support operations they host.
    This form of blocking is done either by configuring mail servers to reference published DNSBL blocklists such as the SBL, SPEWS, SORBS, or the AHBL. (See links to these and more on main page of this web site.)
    I favor the DNSBL approach, because it not only blocks the majority of the spam, it also throws back responsibility for the spam or spam support services and resources to the hosting ISPs. It is my opinion that any ISP that allows net abuse to continue to come from its netblocks after receiving complaints should expect the rest of the Internet community to simply refuse all traffic until the offending ISP has cleaned up its act.

    The Internet is by definition a voluntary association of privately owned networks. It is not a public network. Common carrier law does not apply. Any voluntarily connected privately owned network has the right to accept or reject any and all traffic into and out of the network as declared fit based on determination of its impact on the privately owned network resources. I run my own email and web servers, and the bottom line is that spammers do not have the right to push their cost-shifted abuse onto my property. See my letter on this issue to Senator Lugar of Indiana in 2003 for my reasoning on this:
        Spam Email Legislation Issues: Free Speech or Trespass to Chattel

    wired.com. January 19, 2004.
    Do not use profanity. Be very careful when discussing financial or business affairs. Avoid any mention of your private parts. Do not offer any guarantees, or refer to checks that may or may not be in the mail.
    Refrain from describing anything or anybody as "free." Abstain from the exuberant use of punctuation marks. Shun simple salutations like "Hello," and opt instead to craft a detailed, personalized subject line.
        Spam Filters Grab Good With Bad