Powerful Spam Filter for SpamCombat

Have you ever met in your Inbox spam emails addressed not to your email account? Here is what I am talking about. I have two email addresses press@mydomain.com and julia@mydomain.com. I regularly let pass the messages I receive on those two accounts through an anti-spam filter, G-Lock SpamCombat. G-Lock SpamCombat deletes spam and I pull down only good messages with Outlook Express then. Not a long time ago I noticed that many spam messages had the email address that I didn't used in the To field. I.e. they were not addressed to me. For example, a message was addressed to bounced@mydomain.com or to remove@mydomain.com but arrived to my email address press@mydomain.com. Surely it was spam. Such spam messages are generated with special software, which forges the message header in order to fool anti-spam filters. This is a quite effective spam tactic I must say because none from G-Lock SpamCombat filters could block such spam emails. So, the necessity to elaborate a new filter stood up. Since G-Lock SpamCombat allows using a script in the filters, G-Lock Software developers wrote a script specifically to catch spam emails addressed not to our email accounts. We checked how the filter worked in life and we are enjoying its great work up to now. So, I'd like to share the filter with you now.

With G-Lock SpamCombat

- click on Edit menu
- select Complex Filters
- click Add button at the bottom of the Complex Filter screen
- enter a filter name: Email not to my account
- enter the Input variables:

_To=
Cc=
Account_Name=

- copy and paste the code below:

_To:= LowerCase(_To);
Cc := LowerCase(Cc);
Result := -1;

MyEmail := 'press@mydomain.com';

if (Account_Name = 'Press') and (pos(MyEmail, _To)=0) and (pos(MyEmail, Cc)=0)
then
begin
Result := 1;
Reason := 'Email not to Press';
end;

MyEmail := 'julia@mydomain.com';

if (Account_Name = 'Julia') and (pos(MyEmail, _To)=0) and (pos(MyEmail, Cc)=0)
then
begin
Result := 1;
Reason := 'Email not to Julia';
end;

Replace my email addresses within the script with yours. If you have more email accounts, you can enhance the script by adding more blocks to it. Note that Account_Name used in the script equals the Display Name of your account.

You can use this filter in any anti-spam program, which supports the script to filter email. We hope that the filter will be as effective for you as it is for us.

Share this post

#1. marisp, 1 year and 9 months ago

You can edit the code so that the emails you are subscribed to will be classified as good by the Complex filter. For this purpose, add as many Return-Path emails as you are subscribed to in If and type 0 in Result. 0 means the email is good. If you type -1, the email will be marked as unresolved and will be transmitted to the Whitelist, etc.

for a single Return-Path email:

I have excluded my forum notifications from blacklisting by Complex Filter:

Code:
if (pos('apache@wiggum.tera-byte.com',Return_Path)<>0) then Exit;

for several Return-Path emails:

Code:
if (pos('apache@wiggum.tera-byte.com', Return_Path)<>0) or
(pos('b@b.com', Return_Path)<>0)
then
begin
Result := 0;
Reason := 'Mailing lists subsription';
Exit;
end; // excludes forum, mailig lists notifications

So full code example:

Code:
_To:= LowerCase(_To); // case insensitivity
Cc := LowerCase(Cc);
Result := -1;

if Return_Path='apache@wiggum.tera-byte.com' then Exit; // excludes forum notifications

// My Account 1 --------------------------------------------------------------
MyEmail := 'email@domain.com';

if (Account_Name = 'My Account 1') and // Account Name is a Display Name in the Account Settings
(pos(MyEmail,_To)=0) and
(pos(MyEmail, Cc)=0)
then
begin
Result := 1;
Reason := 'Email not to My Account 1';
Exit;
end;

#2. Albert Keur, 1 year and 9 months ago

_To:= LowerCase(_To);
Cc := LowerCase(Cc);
Result := -1;

This don't works by me. Why???
I have send an email with my account to myself. Complex filters blocked this email.

MyEmail := 'hidden@wxs.nl';

if (Account_Name = 'akeulee') and
(pos(MyEmail, _To)=0) and (pos(MyEmail, Cc)=0)
then
begin
Result := 1;
Reason := 'Email not to akeulee';
Exit;
end;

What if I say,

if (Account_Name 'akeulee') and
(pos(MyEmail, _To)=0) and (pos(MyEmail, Cc)=0)

#3. marisp, 1 year and 9 months ago

Hello Albert, In order we could understand what is wrong, please, save your test message to the disk in the .eml format, then attach the .eml file to a message and send it to us. We will check it out.

#4. Ingrith, 1 month and 23 days ago

I find that there's a *lot* of current spam that simply bypasses the Bayesian filters and is basically a penetration line and a URL.
I'd like a filter that will catch anything with an URL in the body (or any other arbitrary string) Anyone who has any business sending me an URL is already on my Whitelist