Anti-Spam Dictionary

General discussion about PopMan.

Moderator: Christian

Post Reply
Tommy
Posts: 66
Joined: 16 Oct 2005, 07:12

Anti-Spam Dictionary

Post by Tommy »

i opened this topic to collect all our "rules" to avoid spam.

i start putting mine rules to share with you. just copy in your PopMan rules.txt file and you will be free from a lot of spam.

please share with me your personal rules to build a powerful AntiSpam Dictionary.

RULES

Subject contains any of {"miracle drug", "drug!", "Cialls", "Viagr@", "Cheap Meds", "Ci@s", "Vi@ra", "replica watches", "Re:Feel Better", "\/lagra", "p0pular", "Corel draw", "0EM", "di$c0unt", "notizie buffe della", "earn $", "pathogen", "Photoshop", ".gavin", "Cock", "Pills", "cheap software", "viagra", "tingling in your balls", "C_I_A_L_I_S", "V_I_A_G_R_A", "Levltra", "CALIS", "VlAGR@", "Have Meds", "o'hare", "Hi, hit me", "VI@GR@", "Porno", "sh1t", "=jaime", "organdy", "PHroxARMACY", "sexual", "Cialis", "save up to", "US Drugs", "Undelivered Mail Returned", "penis", "v1@gr@", "VI@GR@", "drug$", "v1agra", "c1alis", "p1ll", "p1lls", "C1al.is"} -> MarkForDelete

Message contains any of {"START EARN MONEY NOW", "TUA MOGLIE TI METTE LE CORNA !", "Viagra", "/iagr@", "NOW FOR FREE!", "ejaculation", "Enlarge your penis", "http://www.wer-wer.com/ep/", "cheap software"} -> MarkForDelete
User avatar
Christian
Site Admin
Posts: 393
Joined: 11 Jan 2004, 13:04
Location: Magdeburg, Germany
Contact:

Post by Christian »

Maybe it's better when you include some "white words" too:

Subject contains any of {"miracle drug", "drug!", "Cialls", "Viagr@", "Cheap Meds", "Ci@s", "Vi@ra", "replica watches", "Re:Feel Better", "\/lagra", "p0pular", "Corel draw", "0EM", "di$c0unt", "notizie buffe della", "earn $", "pathogen", "Photoshop", ".gavin", "Cock", "Pills", "cheap software", "viagra", "tingling in your balls", "C_I_A_L_I_S", "V_I_A_G_R_A", "Levltra", "CALIS", "VlAGR@", "Have Meds", "o'hare", "Hi, hit me", "VI@GR@", "Porno", "sh1t", "=jaime", "organdy", "PHroxARMACY", "sexual", "Cialis", "save up to", "US Drugs", "Undelivered Mail Returned", "penis", "v1@gr@", "VI@GR@", "drug$", "v1agra", "c1alis", "p1ll", "p1lls", "C1al.is"}
OR
Message contains any of {"START EARN MONEY NOW", "TUA MOGLIE TI METTE LE CORNA !", "Viagra", "/iagr@", "NOW FOR FREE!", "ejaculation", "Enlarge your penis", "http://www.wer-wer.com/ep/", "cheap software"}
AND
To contains none of {"firstname", "lastname"}
AND
Message contains none of {"PopMan", "Your company", "Another buzz word"}

-> MarkForDelete


But only use the firstname/lastname check, if your name is not part of your email adress, otherwise it will always be found, so your rule never applies... In the next Beta I will have to add the possibility to search for entire words only, so that the string "huebner" will not be found in "chuebner@ch..."! Maybe we can indicate word search by enclosing the word in single quotes:

To contains none of {'Christian', 'Hübner', 'Huebner'} [...]
Christian Hübner
Tommy
Posts: 66
Joined: 16 Oct 2005, 07:12

Post by Tommy »

good point.

however my idea is to create a big "bad words" list that are frequently present in spam mail.

if we join effots we will defeat spammers
User avatar
Jeroen
Posts: 53
Joined: 24 Jan 2005, 09:05
Location: Delft, Netherlands
Contact:

Post by Jeroen »

Tommy wrote:if we join effots we will defeat spammers
I'm afraid we'll never "defeat" spammers. Using a wordlist like this will absolutely filter some stuff, but it would become a HUGE list, if we have to enter every possible forbidden word AND all senders which are allowed to sent any message.

I think it's a far better idea to combine PopMan with, for example, a tool like K9 (http://www.keir.net/k9.html), which has a learning filter and blocks an awfull lot of spam on my side. It can mark all mail with, for example, the word [SPAM] in the subject, so PopMan can remove those messages using it's filters.

Anyway, your initiative is a good one, but only a very small drop in the pool of spam-fighting.
Jeroen
Tommy
Posts: 66
Joined: 16 Oct 2005, 07:12

Post by Tommy »

what i men is to create a big list of the most used spam words.

words like "C1al.is" or "V1@_gr@" can never come from a friend but only from a spammer.

i was just asking to copy your "mark for delete" rules to create some kind of basic antispam dictionary that can prevent at least a good percentrage of spam mail.
Tommy
Posts: 66
Joined: 16 Oct 2005, 07:12

Post by Tommy »

i'm pasting here an updated version of my rules with more "spam" words" added.

i hope that somebody will post his rules to make the antispam dictionary bigger and better

TOMMY'S RULES

Subject contains any of {"Re[", "salvag875", "RE: HELLO", "HI !..", "$tyles", "Replica", "your credit", "Office XP", "sex", "gangplank", "pron", "p0rn", "Feel better now", "software", "v!@gra", "T@b.s", "$oftware", "$aving$", "AllWomenYour", "http://www.discountcanadianmedicine.com", "Adobe", "Libero Spot", "Now is your chance", "Important Information", "Much Bigger", "$oft", "[SPAM-PROTECT]", "Cheap Drugs", "Cial", "Xan", "Vaig", "OEM", "sp3rm", "fukc", "s0ftw@re", "////", "low prices", "labs tabs", "VI@GR@", "erection", "Re:SOFT", "ROLEX", "/!agra", "miracle drug", "drug!", "Cialls", "Viagr@", "Cheap Meds", "Ci@s", "Vi@ra", "replica watches", "Re:Feel Better", "\/lagra", "p0pular", "Corel draw", "0EM", "di$c0unt", "notizie buffe della", "earn $", "pathogen", "Photoshop", ".gavin", "Cock", "Pills", "cheap software", "viagra", "tingling in your balls", "C_I_A_L_I_S", "V_I_A_G_R_A", "Levltra", "CALIS", "VlAGR@", "Have Meds", "o'hare", "Hi, hit me", "VI@GR@", "Porno", "sh1t", "=jaime", "organdy", "PHroxARMACY", "sexual", "Cialis", "save up to", "US Drugs", "Undelivered Mail Returned", "penis", "v1@gr@", "VI@GR@", "drug$", "v1agra", "c1alis", "p1ll", "p1lls", "C1al.is"} -> MarkForDelete

Message contains any of {"http://best-us-drugs.com", "http://www.focry.com", "EVA DOT COM", "http://www.ruewunsuereion.com", "Cia1is", "DIP LOMA", "http://www.osgoenati.com", "Sirenis Group", "http://www.discountcanadianmedicine.com", "Vi@gra", "Vi[agra", "http://gulf-supply.info", "s0ftw@re", "http://www.oemsoftoffer.com/", "http://samlabs.legal-rx-meds.com", "http://www.clever-prduct.com/", "START EARN MONEY NOW", "TUA MOGLIE TI METTE LE CORNA !", "Viagra", "/iagr@", "NOW FOR FREE!", "ejaculation", "Enlarge your penis", "http://www.wer-wer.com/ep/", "cheap software"} -> MarkForDelete

Message contains none of {"a", "b", "c", "d", "e", "f", "g", "h", "i", "j", "k", "l", "m", "n", "o", "p", "q", "r", "s", "t", "u", "v", "w", "x", "y", "z", "-", "_", ":", "!", "?", "."} -> MarkForDelete

# Subject contains any of {""} -> MarkForDelete
Tommy
Posts: 66
Joined: 16 Oct 2005, 07:12

Post by Tommy »

here's another update of my spam dictionary.

actually i'm killing 80-90% of spam mails with it.

you can copy this list in your PopMan's rules.txt file

please, if u have more smap words to include in this list, feel free to contribute to it, i will appreciate it.

Subject contains any of {"credit", "Offfer", "S0FT", "Savvy", "Maddox", "sorry about last night", "Re: the", "Hi,",
"RXcuza", "pleasure", "PHRMACY", "your meds", "Express-credit", "mortgage", "test", "fw[]:",
"VIfAGRA", "Phramacy", "girlfriend", "erectoin", "SOFT", "penetration", "VIuAGRA", "drugstore", "job", "[E]rectile", "bank", "Home-credit", "REQUIRED", "tabIets", "buy", "Fe:", "holes", "CRACK",
"sweetie", "VjlIAGRA", "Sex", "partner", "Playboy", "BestMan", "Regenisis", "Fwd: Help", "Jones..", "Prices", "VIjAGRA",
"VIAGvRA", "Str0ng Buy", "ROLE o X", ";-)", "WE MAKE YOUR WIFE HAPPY!!", "VIiAGrRA", "fuck-a-row", "Swiss invest",
"***BREAKING NEWS ALERT ISSUED****", "VzIAGRA", "p''enis", "Casino", "Charroux", "o''rgasms", "Every man",
"http://edpharm.ls1fun.com", "Sexual Health", "multi-orgasmic", "tabs", "SeasOn", "Low-Price Soft", "P@tches",
"repilcas", "dating", "CIAzLIS", "L00king", "OTC", "S,T,O,C,K", "pillls", "T_abbs", "http://www.restykc.com", "cheapest",
"discount", "nitrogen", "DISCOUNT ORDER", "rolax", "rolex", "rol3x", "enlarge", "cum", "VtAGGrRA", "s e x", "FW:Hi",
"FREE ITALIAN SEX", "Men problems solver", "ONLINE MEDICATION", "y0ur", "pils", "dr@gstore", "Re[", "salvag875",
"RE: HELLO", "HI !..", "$tyles", "Replica", "your credit", "Office XP", "sex", "gangplank", "pron", "p0rn",
"Feel better now", "software", "v!@gra", "T@b.s", "$oftware", "$aving$", "AllWomenYour",
"http://www.discountcanadianmedicine.com", "Adobe", "Libero Spot", "Now is your chance", "Important Information",
"Much Bigger", "$oft", "[SPAM-PROTECT]", "Cheap Drugs", "Cial", "Xan", "Vaig", "OEM", "sp3rm", "fukc", "s0ftw@re",
"////", "low prices", "labs tabs", "VI@GR@", "erection", "Re:SOFT", "ROLEX", "/!agra", "miracle drug", "drug!", "Cialls",
"Viagr@", "Cheap Meds", "Ci@s", "Vi@ra", "replica watches", "Re:Feel Better", "\/lagra", "p0pular", "Corel draw", "0EM",
"di$c0unt", "notizie buffe della", "earn $", "pathogen", "Photoshop", ".gavin", "Cock", "Pills", "cheap software", "viagra", "tingling in your balls",
"C_I_A_L_I_S", "V_I_A_G_R_A", "Levltra", "CALIS", "VlAGR@", "Have Meds", "o'hare", "Hi, hit me", "VI@GR@", "Porno", "sh1t",
"=jaime", "organdy", "PHroxARMACY", "sexual", "Cialis", "save up to", "US Drugs", "Undelivered Mail Returned", "penis",
"v1@gr@", "VI@GR@", "drug$", "v1agra", "c1alis", "p1ll", "p1lls", "C1al.is", "-online", "4u", "adipex", "advicer",
"baccarrat", "blackjack", "bllogspot", "booker", "byob", "car-rental-e-site", "car-rentals-e-site", "carisoprodol",
"casino", "casinos", "chatroom", "cialis", "coolcoolhu", "coolhu", "credit-card-debt", "credit-report-4u",
"cwas", "cyclen", "cyclobenzaprine", "dating-e-site", "day-trading", "debt-consolidation", "debt-consolidation-consultant",
"holdemsoftware", "holdemtexasturbowilson", "hotel-dealse-site", "hotele-site", "hotelse-site", "incest",
"insurance-quotesdeals-4u", "insurancedeals-4u", "jrcreations", "levitra", "macinstruct", "mortgage-4-u", "mortgagequotes",
"online-gambling", "onlinegambling-4u", "ottawavalleyag", "ownsthis", "palm-texas-holdem-game", "paxil", "penis",
"pharmacy", "phentermine", "poker-chip", "poze", "rental-car-e-site", "ringtones", "roulette ", "shemale", "slot-machine",
"texas-holdem", "thorcarlson", "top-site", "tramadol", "trim-spa", "ultram", "valeofglamorganconservatives", "vioxx",
"xanax", "zolus", "-online", "4u", "adipex", "advicer", "baccarrat", "blackjack", "bllogspot", "booker", "byob",
"car-rental-e-site", "car-rentals-e-site", "carisoprodol", "casino", "casinos", "chatroom", "cialis", "coolcoolhu",
"coolhu", "credit-card-debt", "credit-report-4u", "cwas", "cyclen", "cyclobenzaprine", "dating-e-site", "day-trading",
"debt-consolidation", "debt-consolidation-consultant", "discreetordering", "duty-free", "dutyfree", "equityloans",
"fioricet", "flowers-leading-site", "freenet-shopping", "freenet", "gambling-", "hair-loss", "health-insurancedeals-4u",
"homeequityloans", "homefinance", "holdem", "holdempoker", "holdemsoftware", "holdemtexasturbowilson", "hotel-dealse-site",
"hotele-site", "hotelse-site", "incest", "insurance-quotesdeals-4u"}
And From not contains any of {"INSERT HERE THE EMAIL ADDRESS YOU DON't WANNA TO BE FILTERES AS SPAMMER"} -> MarkForDelete
Tommy
Posts: 66
Joined: 16 Oct 2005, 07:12

Post by Tommy »

another update of my antispam rules file:

Subject contains any of {"Re: Re: Re:", "Re: more", "/iagr@", "pills for FREE", "huge", "XP", "Re: Order",
"Voltaren", "PHA", "Congratulations", "satisfaction", "Re: PH", "RMACY", "Re: PHA", "credit", "Offfer", "S0FT",
"Savvy", "Maddox", "sorry about last night", "Re: the", "Hi,", "RXcuza", "pleasure", "PHRMACY", "your meds",
"Express-credit", "mortgage", "test", "fw[]:", "VIfAGRA", "Phramacy", "girlfriend", "erectoin", "SOFT", "VlAfGRA",
"penetration", "VIuAGRA", "drugstore", "job", "[E]rectile", "bank", "Home-credit", "REQUIRED", "tabIets", "buy",
"Fe:", "holes", "CRACK", "sweetie", "VjlIAGRA", "Sex", "partner", "Playboy", "BestMan", "Regenisis", "Fwd: Help",
"Jones..", "Prices", "VIjAGRA", "VIAGvRA", "Str0ng Buy", "ROLE o X", ";-)", "WE MAKE YOUR WIFE HAPPY!!",
"VIiAGrRA", "fuck-a-row", "Swiss invest", "***BREAKING NEWS ALERT ISSUED****", "VzIAGRA", "p''enis", "Casino",
"Charroux", "o''rgasms", "Every man", "http://edpharm.ls1fun.com", "Sexual Health", "multi-orgasmic", "tabs",
"SeasOn", "best friends", "Low-Price Soft", "P@tches", "repilcas", "dating", "CIAzLIS", "L00king", "OTC",
"S,T,O,C,K", "pillls", "T_abbs", "http://www.restykc.com", "cheapest", "discount", "nitrogen", "DISCOUNT ORDER",
"rolax", "rolex", "rol3x", "enlarge", "cum", "VtAGGrRA", "s e x", "FW:Hi", "FREE ITALIAN SEX", "y0ur", "pils",
"Men problems solver", "ONLINE MEDICATION", "dr@gstore", "Re[", "salvag875", "RE: HELLO", "HI !..", "$tyles",
"Replica", "your credit", "Office XP", "sex", "gangplank", "Anacreon", "pron", "p0rn", "Feel better now",
"software", "v!@gra", "T@b.s", "$oftware", "wordwrap", "$aving$", "Dalman", "AllWomenYour", "Adobe", "Libero Spot",
"http://www.discountcanadianmedicine.com", "Now is your chance", "Important Information", "Much Bigger", "$oft",
"[SPAM-PROTECT]", "Cheap Drugs", "Cial", "Xan", "Vaig", "OEM", "sp3rm", "fukc", "s0ftw@re", "////", "low prices",
"labs tabs", "VI@GR@", "erection", "Re:SOFT", "ROLEX", "/!agra", "miracle drug", "drug!", "4u", "mortgagequotes",
"Cialls", "Viagr@", "Cheap Meds", "Ci@s", "Vi@ra", "replica watches", "Re:Feel Better", "\/lagra", "p0pular",
"Corel draw", "0EM", "di$c0unt", "notizie buffe della", "earn $", "pathogen", "Photoshop", ".gavin", "Cock",
"Pills", "cheap software", "viagra", "tingling in your balls", "C_I_A_L_I_S", "V_I_A_G_R_A", "Levltra", "CALIS",
"VlAGR@", "Have Meds", "o'hare", "Hi, hit me", "VI@GR@", "Porno", "sh1t", "=jaime", "organdy", "PHroxARMACY",
"sexual", "Cialis", "save up to", "US Drugs", "Undelivered Mail Returned", "penis", "v1@gr@", "VI@GR@", "drug$",
"v1agra", "c1alis", "p1ll", "p1lls", "C1al.is", "-online", "adipex", "advicer", "credit-report-4u", "incest",
"baccarrat", "blackjack", "bllogspot", "booker", "byob", "car-rental-e-site", "car-rentals-e-site", "carisoprodol",
"casino", "casinos", "chatroom", "cialis", "coolcoolhu", "coolhu", "credit-card-debt", "f0und", "macinstruct",
"debt-consolidation-consultant", "cwas", "cyclen", "cyclobenzaprine", "dating-e-site", "day-trading", "vioxx",
"mortgage-4-u", "debt-consolidation", "holdemsoftware", "holdemtexasturbowilson", "hotel-dealse-site",
"hotele-site", "hotelse-site", "Ditto ", "insurance-quotesdeals-4u", "insurancedeals-4u", "jrcreations", "levitra",
"online-gambling", "onlinegambling-4u", "ottawavalleyag", "ownsthis", "palm-texas-holdem-game", "paxil", "penis",
"pharmacy", "phentermine", "poker-chip", "poze", "rental-car-e-site", "ringtones", "roulette ", "shemale",
"slot-machine", "texas-holdem", "thorcarlson", "top-site", "tramadol", "trim-spa", "ultram", "destroy public",
"valeofglamorganconservatives", "xanax", "zolus", "-online", "4u", "adipex", "advicer", "baccarrat", "blackjack",
"bllogspot", "booker", "byob", "car-rental-e-site", "car-rentals-e-site", "carisoprodol", "casino", "casinos",
"chatroom", "cialis", "coolcoolhu", "coolhu", "credit-card-debt", "credit-report-4u", "cwas", "cyclen", "Celexa",
"cyclobenzaprine", "dating-e-site", "day-trading", "debt-consolidation", "debt-consolidation-consultant",
"discreetordering", "duty-free", "dutyfree", "equityloans", "fioricet", "flowers-leading-site", "FITT.org",
"freenet-shopping", "freenet", "gambling-", "hair-loss", "health-insurancedeals-4u", "hotel-dealse-site",
"homeequityloans", "homefinance", "holdem", "holdempoker", "holdemsoftware", "holdemtexasturbowilson",
"hotele-site", "hotelse-site", "incest", "insurance-quotesdeals-4u", "bargain", "Galaxywide", "viagr", "SSALE",
"Satisfaction Guarantee", "enlargement", "CHECK this out", "Click HERE", "Extra-Time", "biggest", "Burn calories",
"prescription", "coupons", "Banca Mediolanum", "Banca Fideuram", "Prilosec", "VlAGHRA", "LOWEST PRICE",
"President Putin dead", "Find your love!", "Ekaterina", "Claims not to be selling anything", "4U",
"Accept credit cards", "Act now! Don't hesitate!", "Additional income", "Addresses on CD", "All natural",
"Amazing", "Apply Online", "As seen on", "Billing address", "Auto email removal", "Avoid bankruptcy", "Be amazed",
"Be your own boss", "Being a member", "Big bucks", "Bill 1618", "Billion dollars", "Cancel at any time",
"Brand new pager", "Bulk email", "Buy direct", "Buying judgments", "Cable converter", "Call free", "Call now",
"Calling creditors", "Cannot be combined with any other offer", "Can't live without", "Cash bonus", "Cashcashcash",
"Casino", "Cell phone cancer scam", "Cents on the dollar", "Check or money order"}
And From not contains any of {"insert here senders you don't wanna be filtered"} -> MarkForDelete
redder
Posts: 4
Joined: 03 Nov 2006, 20:16

Post by redder »

hmm... wow, a lot of words :) but you have many unneeded duplicates (for example: sex, Sex, Sexual Health, FREE ITALIAN SEX, sexual). i tried to use this method (if i got spam i searched the keywords) but it never will be perfect because ive recently get letters that contains novel-like text. its a kind of pointless and rude spam and you cant block it. well, i thought this until i found this method:

From not contains any of { ... } -> Read, NotNew, MarkForDelete

usage:

its a white list so you should add
- your friends
- your country's code ( .de ) because if youre a member of a forum the admin will send you something like this in the "FROM" column: chuebner@ch-software.de
- or exact sitenames (amazon, yahoo, google, ch-software ect)

maybe its not perfect but more elegant than a hundred-line-list (oh, Christian ive got a feature request: an address book to manage my whitelist more easily)
Tommy
Posts: 66
Joined: 16 Oct 2005, 07:12

Post by Tommy »

if you better read my rules you will see :roll: that a kind of whitelist is already included in the last line of the rule.


:arrow: And From not contains any of {"insert here senders you don't wanna be filtered"} -> MarkForDelete :wink:
Post Reply