Blocking all email from USA?

  • Thread starter Thread starter Ric
  • Start date Start date
R

Ric

Is it possible to make Outlook automatically bin all emails originating in a
particular country (in my case USA). The only emails I ever get from the USA
are spam - and zillions of them - and as I live in EU these are irrelevant
and even more annoying than they presumably are to americans. In the EU we
have laws banning spam so the problem now lies entirely with US. I'd just
like to cut out the US entirely if possible.
 
Ric said:
Is it possible to make Outlook automatically bin all emails originating in a
particular country (in my case USA). The only emails I ever get from the USA
are spam - and zillions of them - and as I live in EU these are irrelevant
and even more annoying than they presumably are to americans. In the EU we
have laws banning spam so the problem now lies entirely with US. I'd just
like to cut out the US entirely if possible.

How do you propose to determine the country of origin?
 
SpamPal has an option to blacklist e-mails originating from particular
countries. They use the country list at http://www.blackholes.us/.
However, blackholes.us does not include a list for the USA, nor do they
cover every country. I, too, would like to block any e-mail originating
outside my country; I'd like to include only those originating from my
country and those that immediately surround it. I'd like to block all
the penis crap originating from prodigy.net.mx (Mexico) because
Prodigy.com (USA) disavows any responsibility or control over what
happens on the Mexican associated domain. Blackholes has a "contact me"
link where you could request they enlarge their country blacklist.

Since spammers often do not originate their crap from their own country,
blocking on the US probably won't help. Have you actually interrogated
the Received headers of all spam e-mails and then performed a lookup on
their IP address to determine the ISP's or provider's registered
physical location (which could still be bogus for spam sourcing ISPs)?
For me in the US, most spam originates outside the US. For you in the
EU, most spam probably originates somewhere outside the EU. After all,
there's nothing, for example, to prevent me in the US from opening a
Yahoo UK account and sending my e-mails from there.

Actually it sounds like you haven't even bothered to use an anti-spam
product to get rid of the spam crap for you. I use SpamPal (whose
author is apparently in the UK) but there are plenty of other anti-spam
products. Just don't bother getting SpamSpector at $30 as it is an
exact code rip-off of SpamPal (free). Does your ISP provide spam
filtering? Have you enabled it?
 
When an organization is assigned a block of IP addresses, the location of
the organization is recorded. This does not record the location where the IP
addresses are used.

Anyone who claims to be able to give you a location based on an IP address
should specify how accurate their process is. It will be substantially less
thatn 100%, and even worse for IP addresses used by spammers and hackers or
anyone else who doesn't want you to know their location.
 
Thanks I will look into Spampal. All the antispam products I have so far
encoutnered use a new interface for email (eg mailwasher) and I would prefer
to keep Outlook as my email client. Sounds like spampal may be different - I
will look into it. I do have loads of ISP filters already in place. Just
filtering out everything with "$" in it keeps out a lot. But spammers are
getting wise and go to lots of evil lengths to fool filters. Besides,
setting new filters all the time gets very tedious.
 
So an ISP in Finland has dial-up and DSL/cable/satellite customers
connected to it from Argentina?

Even using your argument, what stops us from sending complaints to their
*provider* (i.e., upstream of the spam source)? I usually complain to
whomever was assigned the block of IP addresses of which the spam source
is one of them. Why complain to the spammer? You need to complain to
their provider. Yes, I realize that ISPs "sublet" their addresses to
other providers and maybe you can get to those subproviders, or maybe
not.
 
SpamPal uses DNSBLs (DNS blacklists). Spammers are identified by
*where* their spam originates; i.e., if it comes from an identified spam
source then it will get tagged. You might want to play around with
which blacklists you use. Some are a bit too aggressive. When SPEWS
was available, I'd get a few too many false positives.

I also use Outlook as my e-mail client but don't like to leave it loaded
all the time. It's too flakey and doesn't handle bad connections or
logins too well. So I use Magic Mail Monitor as my e-mail monitor.
Magic also has rules (PopTray also has rules but they are unreliable for
the "Header" rules). This lets me poll through SpamPal to have it mark
the spam which Magic can delete from the server using one of its rules.
I never get bothered being notified of new e-mail that is spam nor do I
waste time to download the spam to then detect it and delete locally.
Magic has a logfile you can view on what the rules did if you want to
occasionally check if there were any false positives. Since SpamPal
works just on the headers, Magic can poll for new e-mail and use a rule
to check for SpamPal's "X-SpamPal: SPAM" header; if that header got
added, Magic's rule will delete the e-mail from the server.

SpamPal also has a Bayesian plug-in for statistical weighting of words
within the body (bad word lists are near worthless and incur a lot more
false positives). So for any spam that got missed by SpamPal's
interrogation of the headers, the Bayesian filter can catch most of the
leakage. You can also get the HTML-Modify plug-in which will strip out
the nasties from HTML-formatted e-mails, like web bugs (which spammers
use to check when you have viewed their crap and tells them that their
e-mail arrived to a valid and monitored account). It will also identify
spam based on tricks that spammers use, although you may want to tone it
down a bit (I had to disable its option to identify e-mails as spam that
did not have a plain-text section, such as e-mails from Hotmail). You
should still be using the Restricted Sites security zone to view your
e-mails but none of the security zones will get rid of linked images
(web bugs, beacons). The Quarantine plug-in will let you retain a
text-only version of all e-mails detected as spam. Maybe it wasn't
spam, or maybe you want to include it when reporting it. It doesn't
have an expiration feature to get rid of old spams, so I wrote a batch
file to delete the quarantined spam more than N days old. A RegEx
plug-in gives you more control with regular expressions to detect spam.
A URL plug-in will catch spam that doesn't get caught by SpamPal,
Bayesian plug-in, or HTML-Modify plug-in then this plug-in will catch
e-mails that have URL links to known spam-based web sites. They can try
to hide how they phrase their message and try to send it from somewhere
not yet known as a spam source but somewhere they'll have to insert a
link to their web site.

Do *NOT* waste your money to buy SpamSpector. It is an exact code
rip-off of SpamPal (except they added an installation wizard, but I
found SpamPal very easy to install and configure). They asked the
author of SpamPal if they could usurp his code. SpamPal's author is
very much in the fight against spam and gave them permission to use his
freeware code, but his code is copyrighted and SpamSpector is legally
required to identify SpamPal somewhere (but I haven't yet found them
crediting SpamPal for doing all the work). They want to charge for a
product without providing any royalties or remuneration to the SpamPal
author nor to any of the DNSBLs that it will use to detect spam. They
want to charge you for all the hard efforts of the anti-spam community
that provides the fruits of their labors to you for free. Their
"support" consists of just a web form to submit inquiries. They won't
operate a forum because they know SpamPal users will inundate any
customers that post there with replies that they could get the exact
same product for free. They do NOT have a support forum where you can
ask the authors and other users on how to configure and use SpamPal or
to report problems, but SpamPal.org does. SpamPal is freeware. It is
not nagware, trialware, demoware, crippleware, or adware. SpamSpector
costs $30. SpamPal and all plug-ins are free. If you want a pretty box
then pay the money for SpamSpector. Otherwise, just download SpamPal
and its plug-ins for free. In the case of Linux and various commercial
flavors of it, you do get value in that the vendor collated all the
software and probably provides some support. SpamSpector adds [almost]
nothing to the freeware SpamPal Project. Of course, someone wanting to
make a buck off of spam and usurping an existing freeware product and
extolling all of its virtues is itself a great recommendation ... for
SpamPal, that is!
 
Vanguard said:
So an ISP in Finland has dial-up and DSL/cable/satellite customers
connected to it from Argentina?

An ISP in Finland may have given out some of the IP addresses assigned to it
to someone in Argentina.
Even using your argument, what stops us from sending complaints to their
*provider* (i.e., upstream of the spam source)? I usually complain to
whomever was assigned the block of IP addresses of which the spam source
is one of them. Why complain to the spammer? You need to complain to
their provider. Yes, I realize that ISPs "sublet" their addresses to
other providers and maybe you can get to those subproviders, or maybe
not.

If you can get to a responsible provider, that's fine. I can't imagine that
there are no providers whose business relies explicitly on providing
anonymity to spammers, though.
 
Vanguard said:
When SPEWS was available, I'd get a few too many false positives.

Was?

SPEWS was never "unavailable". The information website was down for a
bit, but that was not the primary means of distributing the DNSbl
listings and the site is back up now.

Anyway, the SPEWS FAQ makes it clear what to expect when you filter
based upon SPEWS listings.
 
Thanks I will look into Spampal. All the antispam products I have so far
encoutnered use a new interface for email (eg mailwasher) and I would prefer
to keep Outlook as my email client. Sounds like spampal may be different - I
will look into it. I do have loads of ISP filters already in place. Just
filtering out everything with "$" in it keeps out a lot. But spammers are
getting wise and go to lots of evil lengths to fool filters. Besides,
setting new filters all the time gets very tedious.


I use Mailwasher and still use Outlook as my client. Mailwasher only
downloads the headers for you to select.
neil
Neil McMullen
Please reply to Group as my email is fake.
 
Yes, SPEWS did become unavailable. SpamPal and other programs using it
had to remove it from their list of DNSBLs. Perhaps SPEWS moved or has
alternate sites (but which are definitely inappropriate for the number
of users and level of traffic for all users to query their list). At
one point, if you had SPEWS included in the blacklists then *everything*
got marked as spam; when they went down, they returned *.*.*.* as a spam
source so every e-mail was spam (rather than just turn off their list
and list software timeout waiting for no response). SPEWS was never
responsible nor responsive; it was *their* list which you could if you
chose. I remember trying to ask others (who program to use their list)
on how to determine *when* they had added a suspected site, and *when*
they did their updates. I could see records but nothing about when
anything was happening. Was the record old, new, obsolete, you didn't
know. That's like reading an online news article that has no date.
Relevance wanes over time.

http://www.spampalforums.org/phpBB2/viewtopic.php?t=2516&highlight=spews
http://www.spampalforums.org/phpBB2/viewtopic.php?t=3044&highlight=spews

Since SPEWS disappeared, and since I didn't care for their 14-year old
attitude towards the effects their lists would have, I just never
bothered even checking if they were available again. Neither has
SpamPal bothered to list them again. The other lists work just fine for
me.
 
The freebie version of Mailwasher only supports *1* account. I have 7
e-mail accounts at present. It also does not support Hotmail. You get
more accounts and Hotmail support only if you buy their Pro version.
Since I can get the same features using Magic Mail Monitor and SpamPal,
all for free, plus I can use YahooPOPs and Hotmail Popper to monitor
(and auto-purge spam), also all for free. I have no inclination to buy
their Pro version. Their freebie version is crippleware. Mailwasher
wants to make a buck off of spam. James Farmer, author of SpamPal, and
other authors of the plug-in are not trying to make a buck off spam.
You can donate if you feel that you would like to support him and help
the fight against spam, but that's purely optional. If I found another
combination of software that worked as well or better - and was free -
then I'd use that.

So with Magic Mail Monitor and SpamPal with its plug-ins, and doing
compare with Mailwasher using their own points list:

- Bounce e-mails. A really stupid and hazardous feature that appeals
only to the uninformed. Spammers don't provide their true e-mail
address. If the e-mail address is valid, it is for some other poor
victim (so you become a spammer is slamming innocents with unsolicited
and unwarranted non-delivery e-mails). The delay in you or a client
program issuing a non-delivery notice is not the same as the SMTP server
refusing e-mail to an non-existent account.

- Delete e-mails (presumably from the server). Yep, using a rule in
Magic to check for SpamPal's header or subject line tag.

- Analyze e-mails. Presumably this means to detect spam. Yep, using
SpamPal.

- Blacklist (this is your personal blacklist). Yep, SpamPal and Magic
both have that.

- Friends list; otherwise known as a whitelist. Yep, SpamPal and Magic
both have that.

- DNS blacklists. Yep, that's what SpamPal uses.

- Filters. Yep, SpamPal's RegEx (regular expressions) can further
identify spam. Magic has rules, too.

- Easy to use interface. Understanding all the features is the hard
part (in knowing what they all do and determining how YOU want the
product to behave). SpamPal's and Magic's UI are easy.

- Drag 'n Drop e-mail addresses. Not sure why you want to drag
anything. In Magic, right-click on an e-mail to add that sender to its
whitelist. For SpamPal's Bayesian plug-in, right-click on the tray icon
to switch whether an e-mail should've been classified as clean or spam.

- Preview pane. Yep, got that in Magic. You can limit how much to
download for the Preview so you don't end up waiting for some garbage
e-mail with a huge attachments, like the malcontents that send viruses
via e-mail. Previews are in text only so you don't have to worry about
HTML nasties, like web bugs or scripts. There is a Load option in Magic
which I'm guessing would download the entire message but I've never used
it; for the e-mails that survived, I want them downloaded into my e-mail
client.

- Grid lines (to aid those that can't figure out how to read across a
line, and must have a terrible time reading books that don't have grid
lines, or have to slide a ruler down the page as they read). There
isn't much whitespace between columns, if any other than a separator, so
determining which fields all belong together in a record is not a
problem.

- Hotmail access. Yep, got that with Hotmail Popper. In fact, although
Outlook and Outlook Express allow you to define an HTTPmail account for
Hotmail (which support only one such account), I still prefer using
Hotmail Popper. By using POP3 to Hotmail Popper, all my messages from
all accounts go into the same Inbox. If you want to know through which
account an e-mail was received, add a column for "E-mail Account" to
show it. I don't get bothered with messages saying Hotmail is
unreachable and that account has to go offline or a bogus
username/password prompt because Hotmail is down and won't present a
page with username and password input text controls.

- Accounts - limited to 1 in free version (unlimited in paid version).
Gee, I don't have to pay anything to use SpamPal or Magic and they
support unlimited accounts.

- Technical support = e-mail & FAQ. SpamPal's author monitors his
forums everyday, as do most of the plug-in authors. Having a ready-made
community of users to query regarding a problem, setup, or suggestion
sure beats NO support for Mailwasher's free version. SpamPal also has a
FAQ. It's called the help file. You don't need info about how to
reregister your copy of the program - because you don't have to register
because you never had to pay for it!

- Affiliate program. SpamPal isn't trying to make a buck off of spam
(but SpamSpector who ripped off SpamPal's code is trying to make a buck,
just like Mailwasher).
 
Vanguard said:
Yes, SPEWS did become unavailable. SpamPal and other programs using it
had to remove it from their list of DNSBLs.

No, Osirusoft became unavailable. SpamPal and other programs were
referencing Osirusoft's SPEWS listing, but Osirusoft was not the
"main" host -- it was just the most commonly used one at the time.
There were other sources for the SPEWS DNSbl list that never went
down. People who knew where to get them (and anyone who did just a
little bit of research could find this information) could keep their
SPEWS listings updated even when Osirusoft went offline.
Perhaps SPEWS moved or has alternate sites

SPEWS has always been multi-homed. They havn't needed to "move",
though some of the mirrors shift about from time to time.
At one point, if you had SPEWS included in the blacklists then *everything*
got marked as spam; when they went down, they returned *.*.*.* as a spam
source so every e-mail was spam (rather than just turn off their list
and list software timeout waiting for no response).

No, this was Osirusoft's doing. Osirusoft used more than just SPEWS
for filtering in the first place, so using their DNSbl as an entry
already blocked more than what SPEWS listed. SPEWS has NEVER listed
*.*.*.*. Osirusoft's listing was an independent action of their own,
people using SPEWS listings taken from other locations weren't having
that problem.
SPEWS was never responsible nor responsive; it was *their* list which you
could if you chose.

Well, that's true.
I remember trying to ask others (who program to use their list)
on how to determine *when* they had added a suspected site, and *when*
they did their updates. I could see records but nothing about when
anything was happening. Was the record old, new, obsolete, you didn't
know. That's like reading an online news article that has no date.
Relevance wanes over time.

SPEWS actually does act fairly quickly when an ISP cleans up its act.
The key, however, is that the ISP must actually clean up their act.
Results, according to their website, may take 24 to 48 hours but
actual experience saw listings vanish within hours or even minutes of
an ISP reporting that it had taken action.

As for entries being added, it's a matter of when the SPEWS spamtraps
get the spam in the first place, and what the ISP does to subsequent
complaints.

SPEWS didn't disapper. The main website went offline. That's it.
The website was just an information zone.
and since I didn't care for their 14-year old attitude towards the effects
their lists would have,

The effect of SPEWS listings, as well as reasoning for this effect, is
well documented on SPEWS's information site. I don't consider it a
"14-year old attitude". I consider it desperate measures for a
desperate situation. SPEWS does what it does because such drastic
measures are needed thanks to criminal ISPs like Cogentco.
I just never bothered even checking if they were available again.

Well, if you had, you would have seen that they were never
"unavailable" in the first place.
Neither has SpamPal bothered to list them again.

Interesting. I'll look into that and find out if they're aware that
they just need to look for SPEWS's lists in a different location.
The other lists work just fine for me.

Then use them, by all means. I'm just letting people know that SPEWS
is not, and never has, been unavailble since its inception.
 
Neither has SpamPal bothered to list them again.
Interesting. I'll look into that and find out if they're aware that
they just need to look for SPEWS's lists in a different location.

From what I read in the SpamPal forums regarding the drop of SPEWS (some
links provided in my prior post), the author and others already knew of
alternate homes for SPEWS but chose *not* to use them because they
weren't considered adequate for handling the load for the high number of
users. Maybe SPEWS has some different hosts now which won't result in
timeouts. Please discuss with SpamPal.org about the alternate homes for
SPEWS to see if they might reconsider using those. Just because I don't
like SPEWS doesn't means others might not want to use them.

I'd still like to see timestamps on their records, especially regarding
the update record. Reading these records is like reading a news story
that has no timestamp: you have no clue as to the relevancy of the
information. Was the spam source added today, yesterday, a week ago, 4
months ago? For the [last] update listed, was that checked today,
yesterday, a week ago, a month ago? Making claims regarding to SPEWS
policy, which isn't published (last time I looked) and what algorithms
or schedules they claim to use cannot be substantiated because of the
lack of timestamps. (Note that I haven't had time yet to peruse the
other blacklists to see if they bother to include timestamps.)
 
I use Rules Wizard to keep out spam (penis enlargement, get-rich quick
pornography, Nigerian scam.....etc). Also, I have set up a rule to ge
rid of the Korean/Asian emails that I cannot read in the first place.
I have been reading about SpamPal and Magic Mail Monitor (shareware).
I am using Outlook 2002 and Windows XP as well as Norton Anti-virus.
Can I use these programs also. I have used other programs (ZoneAlarm
in the past but there seemed to be a conflict between Norton and ZA an
my system was continuously locking up. I am bombarded with garbag
daily and would like one more way to quick receiving this crap. Thank
for your help.

Larr
 
What you need to do is to set up your filters. You can block keywords and full domain names. I would only set up the Junk Mail filters by each address. The reason for this is that you could have a friend who signs up for Hotmail.com account and try to contact you (Hotmail is a USA domain that people worldwide can get)
 
Back
Top