Spam filtering

My exchange is being enabled in April. So I'm currently trying to figure out
a decent supplier to go with.
With reliability being the biggest criteria I'm looking for, the next on the
list is SPAM filtering.

I am currently with Freeserve dial-up and have been for 5 years or so but
the amount of SPAM I receive every day now is beyond a joke.
I easily get about 60 - 70 per day. It's driving me nuts.

Anyone had SPAM problems that have been helped by their suppliers filtering?

cheers

Steven.

On Sun, 18 Jan 2004 09:54:45 +0000, in article
<budl58$p5d$(E-Mail Removed)> "Steven Campbell"
<(E-Mail Removed)> wrote:

> Anyone had SPAM problems that have been helped by their suppliers filtering?

It depends on what they do. If they recognise and reject virus laden mail
for you then that is probably worth having although it is quite easy to do
yourself. It cuts down the traffic to you which is a good thing [TM].

Spam filtering is best done locally, your ISP cannot decide for you what
is spam and what isn't. Everyone has their own view of that.

It is better if they have some sort of scoring system that tells you how
spammy their anti-spam tool thinks it is, but to do that they need to use
something like SpamAssassin to mark up the mail for you. A fair few use
Brightmail, essentially it works by receiving spam on honeypot addresses
and then updating the ISP's blocklist in near real time with data on the
mail that arrived at at least two of them (the addresses are deliberately
not publicised of course). This should in theory never catch single items
of mail to you, but it is just possible that list mail might be caught by
it if the honeypot addresses have become known and someone subscribes them
to a list. Fairly remote possibility of that last though.

There are other solutions that quarantine what is thought to be spam and
then keep it for long enough that you can go and review it before deciding
to bin it or download it.

I think you need to ask any potential ISP more about their spam filtering
solution. That's the first step, then decide whether it will do what you
want. Only you will know that.

It helps to have a domain of your own with mail redirection, then you can
pass mail through third party services that do what you want rather than
being beholden to one ISP's solution.

--

Brian Morrison

please observe reply-to address

The pros and cons of using all the anti-spam measures could easily
fill a book and while every bit of advice you receive, and act on,
will dramatically reduce the spam received, it only takes one false
positive of an essential piece of mail for you to decided none of it
is for you.

So comming back to basics it's a case of having one private email
address which you severley restrict its knowledge of to close friends,
and another, a public one, which the world and their wife know about.
Once the public email address gets swamped with spam, then create
another and no longer download messages off the server of the previous
email address into your email client.

From time to time use something like POP3 SCAN to display the headers
of all the junk mail so that you can remove those emails off your
server to recover the space that they are taking. Failure to do so
may result in the quota for your account being exceeded and therefore
no new emails can be received.

A Freeserve account is in the format of:
<any.name>@<yoursubdomain>.freeserve.co.uk and while you can use
<yoursubdomain>.freeserve.co.uk as your logon details it will download
off the mail server all the emails addressed to that domain
irresepective of what appears before @ sign. However if you set up
your email client with the email address,
<specific.name>@<yoursubdomain>.freeserve.co.uk, your email client
will only be populated with emails of that address.

As you will be having two Freeserve email accounts then your email
client will require an entry for each specific email address that you
wish your email client to be populated with.

I would suggest that you at least give this technique a try before
going down the route of any anti spam filtering methods, after its
free and requires only a one off set-up with no maintenance issues. Be
interested to learn how you get on.

This response is based on the assumption that Freeserve is being used;
it is something I do and it works well for me. I have no idea if the
concepts given here would work with other ISPs.

DAVID BRADLEY

On Sun, 18 Jan 2004 10:47:57 +0000, Brian Morrison
<(E-Mail Removed)> wrote:

>On Sun, 18 Jan 2004 09:54:45 +0000, in article
><budl58$p5d$(E-Mail Removed)> "Steven Campbell"
><(E-Mail Removed)> wrote:
>
>> Anyone had SPAM problems that have been helped by their suppliers filtering?
>
>It depends on what they do. If they recognise and reject virus laden mail
>for you then that is probably worth having although it is quite easy to do
>yourself. It cuts down the traffic to you which is a good thing [TM].
>
>Spam filtering is best done locally, your ISP cannot decide for you what
>is spam and what isn't. Everyone has their own view of that.
>
>It is better if they have some sort of scoring system that tells you how
>spammy their anti-spam tool thinks it is, but to do that they need to use
>something like SpamAssassin to mark up the mail for you. A fair few use
>Brightmail, essentially it works by receiving spam on honeypot addresses
>and then updating the ISP's blocklist in near real time with data on the
>mail that arrived at at least two of them (the addresses are deliberately
>not publicised of course). This should in theory never catch single items
>of mail to you, but it is just possible that list mail might be caught by
>it if the honeypot addresses have become known and someone subscribes them
>to a list. Fairly remote possibility of that last though.
>
>There are other solutions that quarantine what is thought to be spam and
>then keep it for long enough that you can go and review it before deciding
>to bin it or download it.
>
>I think you need to ask any potential ISP more about their spam filtering
>solution. That's the first step, then decide whether it will do what you
>want. Only you will know that.
>
>It helps to have a domain of your own with mail redirection, then you can
>pass mail through third party services that do what you want rather than
>being beholden to one ISP's solution.

> I am currently with Freeserve dial-up and have been for 5 years or so but
> the amount of SPAM I receive every day now is beyond a joke.
> I easily get about 60 - 70 per day. It's driving me nuts.

Ahhh the joys of 60-70 per day - them were the days :-} (I check 8
accounts at a time, and can get that per hour)

I use mailwasher, and with a little careful filtering you can get shut of
an awful lot automatically, as well as seeing who/from/subject without
having to download the entire email.

I`m currently having a rethink on my methods, so i`ll post an update in a
couple of days time - I used to have a *lot* of domains blacklisted which
I think was dragging down the overall speed of checking / deleting the
crap - i`ve now simply left in the country coding ie. *@*.us *@*.biz and
deleted all the other domains temporarily.

I use filters checking if the mail was actually addressed to me or
contains particular words. A trial run about an hour ago was actually
quite successful and marked all the crap for deletion without being shown
as blacklisted. I`ve got these categorised into finance / medical /
general spam categories, so they should be easy for other people to use
and edit as they see fit.

> Anyone had SPAM problems that have been helped by their suppliers filtering?

Given the level of spam, its hard to figure out if they`re harbouring
stuff you actually want depending on how the filtering works.

BTinternet have a webmail front end, which afaik is the only way to check
the contents of the spam directory. The problem being you only see 8 or
10 messages at a time, and when there are 200+ pages of this shit its
very easy to lose all hope and hit the big "delete all spam" button
instead...

--
Please add "[newsgroup]" in the subject of any personal replies via email
* old email address "btiruseless" abandoned due to worm-generated spam *
--- My new email address has "ngspamtrap" & @btinternet.com in it ;-) ---

Thanks guys for all the suggestions.
I should have mentioned I have my own domain that goes through uk2.net.
They have free SPAM filtering which obviously was doing nothing. They also
have a paid for service that blocks all exe's and supposed known blacklisted
spammers. I'm in 2 minds whether to purchase the SPAM filter or just bite
the bullet and register another domain and do as David suggested and be very
selective in who I give it to, but it means I will still have to check my
old email address every now and then.

When I first started using Mailwasher a couple of months ago I was only
getting 2 or 3 Spam's a day. I have been using all 3 options in it, "Delete,
Bounce and Blacklist" I have since read in a few forums / Newsgroups that
bouncing emails from Mailwasher pro only serves to show that it has been
bounced from a live email address. I don't know if that is true but it would
certainly explain why I have went from 2-3 to 60-70 a day. Something to do
with the headers apparently!!!

Steven.

> When I first started using Mailwasher a couple of months ago I was only
> getting 2 or 3 Spam's a day. I have been using all 3 options in it, "Delete,
> Bounce and Blacklist" I have since read in a few forums / Newsgroups that
> bouncing emails from Mailwasher pro only serves to show that it has been
> bounced from a live email address. I don't know if that is true but it would
> certainly explain why I have went from 2-3 to 60-70 a day. Something to do
> with the headers apparently!!!

Part of the problem with bouncing is the mail wasn`t from a legitimate
source anyway 90% of the time, so bouncing does nothing to prevent them
hitting you again. Besides, its easier for a spammer to re-spam the same
bouncing email addresses than to clean up their lists.

If its any help i`m happy to share my filter list - I have a couple of
lines where it checks all 8 accounts and if the mail isn`t addressed to a
valid address it`ll mark it as spam, and another where it checks the
subject line for the prefix of my email address (ie per below, who the
hell would send legitimate mail with the prefix in the subject line like
this - "RE:btiruseless, v|@gr@ che@p"

--
Please add "[newsgroup]" in the subject of any personal replies via email
* old email address "btiruseless" abandoned due to worm-generated spam *
--- My new email address has "ngspamtrap" & @btinternet.com in it ;-) ---

On Sun, 18 Jan 2004 09:54:45 -0000, "Steven Campbell" <(E-Mail Removed)>
wrote:

>My exchange is being enabled in April. So I'm currently trying to figure out
>a decent supplier to go with.
>With reliability being the biggest criteria I'm looking for, the next on the
>list is SPAM filtering.
>
>I am currently with Freeserve dial-up and have been for 5 years or so but
>the amount of SPAM I receive every day now is beyond a joke.
>I easily get about 60 - 70 per day. It's driving me nuts.

I've been with Freeserve broadband for 2 months now
without problems.

>Anyone had SPAM problems that have been helped by their suppliers filtering?

It's a problem for everyone. I had 26 spams and 6 genuine EMails
this morning.

I use a utility to kill spam on the ISP's server - never let it
get near my hard disc. I do it manually as I don't trust myself
to set up mail-kill rules properly.

There is such a plethora of spam filtering programs available, that
it would be difficult to recommend any particular one.

--
Jock.

Steven Campbell wrote:

> My exchange is being enabled in April. So I'm currently trying to figure out
> a decent supplier to go with.
> With reliability being the biggest criteria I'm looking for, the next on the
> list is SPAM filtering.
>
> I am currently with Freeserve dial-up and have been for 5 years or so but
> the amount of SPAM I receive every day now is beyond a joke.
> I easily get about 60 - 70 per day. It's driving me nuts.
>
> Anyone had SPAM problems that have been helped by their suppliers filtering?
>
> cheers
>
> Steven.
>

The PlusNet Easystart package as anti-Spam and Anti-Virus protection on
the email...

Personally, I prefer to handle it myself using POPFile.

On Sun, 18 Jan 2004 09:54:45 -0000, "Steven Campbell"
<(E-Mail Removed)> wrote:

>I am currently with Freeserve dial-up and have been for 5 years or so but
>the amount of SPAM I receive every day now is beyond a joke.
>I easily get about 60 - 70 per day. It's driving me nuts.

You need SpamPal (http://www.spampal.org/)

Download Page: http://www.spampal.org/download.html
Plugins Download Page: http://www.spampal.org/plugins.html

recommend plugins: Bayesian (filtering) & HtmlModify (for killing web-bugs)

Manual: http://www.spampal.org/docs.html

There an easy setup config program here (after downloading SpamPal):
http://www.everydesign.com/products/spampal.asp

Cheers,

Steve

On Sun, 18 Jan 2004 09:54:45 -0000, "Steven Campbell"
<(E-Mail Removed)> wrote:

>Anyone had SPAM problems that have been helped by their suppliers filtering?

I found www.spamache.com to be the best solution, you can apply it to
your freeserve email box for a week's trial.

IMO its advantages over other approaches are:

1. It keeps deleted stuff for you to sift through, for a while
2. It has "whitelist" for things to always accept, and "blacklist" for
things to always reject.
3. It works at server level so you don't have to use your connection
to clean out the spam - handy if you are on a crappy line or using a
mobile. No software to run.
4. The "mustlist" that only accepts mail to defined users, ueful if
you get multiple messages to anybody@yourdomain you can accept only
the anybody that exists

yes it costs money, but its a lot cheaper than trying to wrestle with
1000 spams on a GSM phone roaming overseas :-)

I have found spamache to be well over 90% effective at killing spam.
BT Internets product was about 50% and spamache cleared out virtually
everything that BT let through.

Phil