Spam Filtering

[WhiteShepherd]

If anyone wished to talk about the ins and outs of spam filtering let me know.  

Ours is based on a e-mail score.  Bad phrases from known spamers will give the e-mail a + score.  Good things strings (fur, furry, furtopia, dragoncity) will give subtract from it's score.  Any e-mail with a score over 50 gets the boot. '>

Bellow are a few logs from the spam filter showing how things were scored.  On average Furtopia gets hit with 1 spam message every 5-10 seconds.  In Ohio it's illegal to spam e-mail addresses at some domains (including ours).  But there are so many people who don't care how much they hurt someone's bandwidth as long as they can take somebody's money it's all worth it to them.  So the next step is to guard dog the e-mail gates.

The reject logs are HUGE in multi-megs already.  But I can't help but grin every time I look at the logs knowing I've so far kept the plague outside. '>


Take a look bellow.  Most addresses are faked.  But our program searches the whole e-mail.  Take a look you'll notice negative scores are kept:

Invoked: Tue Jul  1 15:09:54 2003
From: <owner-ohiofur@serv.breuckman.com>
To: pegasus@fur.mine.nu
 maildog@fur.mine.nu
Score: -10000, List S, match *ohiofur*
Score: -10000, List B, match *ohiofur*
Total Score -20000
Message kept

Invoked: Tue Jul  1 15:11:21 2003
From: <bounce@joker.com>
To: fuzzydog@whiteshepherd.net
Score: -10000, List S, match *furtopia*
Score: -10000, List B, match *furtopia*
Total Score -20000
Message kept

Invoked: Tue Jul  1 15:11:27 2003
From: <bounce@joker.com>
To: fuzzydog@whiteshepherd.net
Score: -10000, List S, match *furtopia*
Score: -10000, List B, match *furtopia*
Total Score -20000
Message kept

Invoked: Tue Jul  1 15:11:30 2003
From: <phr201@aol.com>
To: fuzzydog@whiteshepherd.net
Score: 100, List B, match *money back guarantee*
Total Score 100
Reject as: 554 Mail rejected by server. Spam not accepted at this domain!!  If in error e-mail: nospam@furtopia.org

Invoked: Tue Jul  1 15:12:54 2003
From: <benjamin@furtopia.org>
To: *****@hotmail.com
Score: -10000, List B, match *furtopia*
Total Score -10000
Message kept

Invoked: Tue Jul  1 15:21:31 2003
From: <phr201@aol.com>
To: fuzzydog@whiteshepherd.net
Score: 100, List B, match *money back guarantee*
Total Score 100
Reject as: 554 Mail rejected by server. Spam not accepted at this domain!!  If in error e-mail: nospam@furtopia.org

Invoked: Tue Jul  1 15:42:57 2003
From: <frb568t@epatra.com>
To: fuzzydog@fur.mine.nu
Score: 100, List S, match *adv:*
Total Score 100
Reject as: 554 Mail rejected by server. Spam not accepted at this domain!!  If in error e-mail: nospam@furtopia.org

Invoked: Tue Jul  1 15:51:31 2003
From: <phr201@aol.com>
To: fuzzydog@whiteshepherd.net
Score: 100, List B, match *money back guarantee*
Total Score 100
Reject as: 554 Mail rejected by server. Spam not accepted at this domain!!  If in error e-mail: nospam@furtopia.org

Invoked: Tue Jul  1 16:51:31 2003
From: <phr201@aol.com>
To: fuzzydog@whiteshepherd.net
Score: 100, List B, match *money back guarantee*
Total Score 100
Reject as: 554 Mail rejected by server. Spam not accepted at this domain!!  If in error e-mail: nospam@furtopia.org

Invoked: Tue Jul  1 17:51:32 2003
From: <phr201@aol.com>
To: fuzzydog@whiteshepherd.net
Score: 100, List B, match *money back guarantee*
Total Score 100
Reject as: 554 Mail rejected by server. Spam not accepted at this domain!!  If in error e-mail: nospam@furtopia.org

Invoked: Tue Jul  1 18:51:34 2003
From: <phr201@aol.com>
To: fuzzydog@whiteshepherd.net
Score: 100, List B, match *money back guarantee*
Total Score 100
Reject as: 554 Mail rejected by server. Spam not accepted at this domain!!  If in error e-mail: nospam@furtopia.org

Invoked: Tue Jul  1 21:21:31 2003
From: <phr201@aol.com>
To: fuzzydog@whiteshepherd.net
Score: 100, List B, match *money back guarantee*
Total Score 100
Reject as: 554 Mail rejected by server. Spam not accepted at this domain!!  If in error e-mail: nospam@furtopia.org

Invoked: Wed Jul  2 00:29:27 2003
From: <quotes6806@powerfulquotes.com>
To: kada-ru@kcff.net
Score: 100, List B, match *click here*
Score: 100, List B, match *weight loss product*
Score: 100, List B, match *special offer*
Total Score 300
Reject as: 554 Mail rejected by server. Spam not accepted at this domain!!  If in error e-mail: nospam@furtopia.org

Invoked: Wed Jul  2 01:29:25 2003
From: <carlos1qdft@redsplace.biz>
To: fuzzydog@whiteshepherd.net
Score: 100, List B, match *our customers*
Total Score 100
Reject as: 554 Mail rejected by server. Spam not accepted at this domain!!  If in error e-mail: nospam@furtopia.org

[grasper]

Cool, did you write the program yourself,  or what?

[Wtcher]

I'm assuming he's using Spam Assassin or something. '> Am I wrong?

[grasper]

Oh...

[WhiteShepherd]

Actualy I'm using a program called Weasel and Weasel Filter.  The filters I have made over the last year.  Every time a spam gets through I add strings from it to catch.  So the net gets tighter and tighter. '>

[grasper]

cool