The "To:" Section. Info in this section shows where the e-mail was delivered to. Often, this is a weak place to put a block because spammers take advantage of catch-all e-mail boxes. They send it to Anybody@yourdomain.com and whoever has the catch-all e-mail box will get it. So you might set up a block on anything sent to Anybody@yourdomain.com. Tomorrow they'll use Nobody@yourdomain.com and get by the block of "Anybody@yourdomain.com" that you'd set up. One thing this section is good for is to stop mail from going to someone who's left the company.

The "From:" Section. In short, this is easily forged and can be changed as easily as the "To:" address. This is userful to block out those annoying friends who keep sending you chain letters. Blip, you'll never have to look at those again.

The "Subject:" Section. Now we're getting some power. Want to stop the e-mails with XXX or SEX or Work At Home in the subject line? This is the place to do that. Be careful about blocking short words such as "sex." What if the subject were, "Life is great in Essex Park"? It might be better to put a space before and after the entry so that in doesn't include anything other than the single word sex.

The "Header:" Section. Info in this section is blocked using the H (Head) trigger in SpamVault. This is one of the most powerful areas for blocking because you can block an entire network in one fell swoop. (Please note that "Powerful" does not mean easy. It means, if you use it incorrectly, you can easily block all of your email.)

There are some services that are friendly to spammers; they even encourage spamming. They permit or profit from spamming on their server network. Often, you'll get many different looking spams from one network and not realize it, because the return addresses are phony. Before we decide what to block, remember to block as little as possible by using a well targeted entry. Casting too wide a net or making a lot of unnecessary entries just makes the server work harder for no reason and will block email you will have wanted to receive. So, looking at the Received: section, here are some potential candidates for blocking in order of preference. 1) spamnetwork.com 2) spammers_isp.com (but be careful, if the guy's on America Online, you've just blocked everyone on AOL). Also, there are often more than one Received: entry, use the last one ONLY.

Spammers and Their Tricks:

We have to confess that SpamVault is not the end of all spam, but it will give you better control over your circumstances. In our test and experience we've been able to reduce spam by well over 95%. Still, spammers are always devising tricks to work around all spam-blocking software and we're constantly trying to prevent them from doing so. One way they may get around SpamVault is to trick you into blocking the wrong section of the e-mail header. Technically speaking, it's easy to fake almost all but the Header section of an e-mail. And without a trained eye, it's hard to sort out truth from fiction. You might block everything coming from one e-mail address and all they have to do is fake you out by using another e-mail address. Using this trick it can look like they're sending from a hotmail.com address today and a different address tomorrow. Here is where the power of the 'Received' section of the header comes in and why it's important to review the header of your e-mail rather than the default to and "From:" sections.

A spammer typically is not be able to change the information in the 'Received' section of the header. So, using that as a filter can be the strongest method of blocking e-mail. Please do not just paste the entire 'Received' section into SpamVault. You need to review the header for a specific server name and sometimes an IP number (but these change regularly so it is not recommended). In the example above, the network that the spam is coming from is welove.spamnet.com. We would recommend that you only use the last and second to the last section of the network name: spamnet.com.

Spammers are using HTML-based email more and more lately. Unfortunately for them, while it's often easy to fake parts of the headers, when it comes to the body of the email, they almost always provide some method of contacting them and thus, give you something to block. It's especially hard to hide the references to their domains and IP addresses in the links of the source code. The trick is to view the source code of the email (usually by right clicking on the email itself) and then search for the text "<href=...". There is usually more than one of these. Following this is a reference to the server that the page links to. Grab just the domain name and block that. SpamVault will read that in the source code of the email as it passes through and block those emails in the future.

Many companies get duped by professional spamming companies into thinking that there's some money to be made in massive emailings. Maybe for the spammer there is. The one common theme in this type of email is that the advertisers links will probably always change in the body of the email but the "unsubscribe" link is probably directed right at the spam provider since they're the ones doing the spamming. When given a choice, I'd take the unsubscribe link domain name over the one in the body of the letter.

Error Messages:

Three are several error messages that may appear while using SpamVault. Most of these are self explanitory but some may need a little further explaination.

User ID Authentication Failure: SpamVault performs a security check to make sure you arrived here from your control panel. Unfortunately, your browser is not showing the proper information. Note: This error occurs if you're blocking cookies or browser history via a firewall or within your browser configuration or if you are not accessing this program from your control panel. You should correct this and then press the line below to reload SpamVault.

If you're using ZoneAlarm Pro the best way to prevent this error is very easy and it won't compromise your security. Click the Privacy tab on the left > Select the Site List tab at the top > place a check mark  in the column labeled "Private Header".

---

Warnings and Cautions:

When someone uses the term 'powerful program,' this is code for 'you can really mess things up with this program if you're not careful.' SpamVault is a powerful program and therefore you should be very selective in the entries you make. Adding an entry that only contains the letters '.com' in it will block all e-mail coming from any e-mail address that has '.com' in it. If all of a sudden your e-mail doesn't work, check your entries in SpamVault before you contact support.

Illegal Characters. Only use the following characters in your entries as other characters such as a bracket "[" will cause very predictable results (all bad). You can use the following characters: A - Z, a - z, 0 - 9, period (.), dash (-), Underscore (_), and the At symbol (@).

Only if you are one of the very few people in the world who understand "Procmail" escape characters can you use backslash (), forward slash (/), dollar sign ($), exclamation point (!), quotes (" or '), and the question mark (?).

Advanced features of SpamVault

This section is a special tutorial for advanced SpamVault users. The features shown here may not be supported by our tech support staff and therefore you are using them at your own risk. The reason for this is that any mistakes in this document or in your email entries can cause you to block all of the email going to your account. Now that you've entered all the dirty words in your vocabulary and are still getting spam, here are some tips.

New Entry Filters

SpamVault works by integrating itself with the email software (called Procmail) on the server. It is Procmail that actually blocks the email and SpamVault that tells Procmail what to block. The Procmail syntax has some special characters that when used in an entry take on special meaning. SpamVault checks each new entry for illegal and sensetive characters in an effort to prevent novice users from unintentionally blocking email. This document will show you some tips on blocking emails using some of the special characters.

When you use special characters, such as those that are not "A-Z", "a-z" and "0-9", you may get a warning that notifies you that there might be a problem with some of the characters in your entry. For instance, an entry with a "%" sign will trigger such a warning even though your entry is accepted. If you use characters that have special meanings for Procmail your entry will be rejected outright.

To enable you to work with these characters, you have to edit an existing entry. Existing entries are not screened for illegal characters. For example, enter this: "Save 50%" (w/o quotes) and you'll get a caution as follows:

CAUTION: The string you entered contains characters that if not used properly can cause problems with your email. Unless you are sure you know what you are doing, try using a-Z, 0-9, period (.), Underscore (_), and the At symbol (@). Entry Accepted but may cause trouble: [Save 50%]

Advanced users will need to use characters that if not used properly will cause problems. When these characters are entered, your entry will not be accepted through normal means and you'll get the following warning:

WARNING: The string you entered has illegal characters in it. Try using a-Z, 0-9, period (.), Underscore (_), and the At symbol (@). Offending Entry not accepted: [!@#$%^]

To get around this message you simply have to first add an entry that will be accepted. For instance add, "abcdefg" and then edit it after it's been accepted.

Feel the power...

Here are a few tricks that you can use to screen out even more spam.

Let's say you want to save space by putting several entries into one line. For instance: dog, cat and mouse. Just enter "dog|cat|mouse" (without quotes but with the pipe symbol) into one entry. This will work on the other options as well for instance the from address of more than one person: "junkmail.com|spamco.com|hatemail.com". Note: entries area taken as a whole when SpamVault looks for a duplicate and sorts them. Therefore, in the above example, if you added "dog" as a new entry, it would not be considered a duplicate.

Regular Expressions

The term "Regular Expressions" is a programming code that does not mean expressions that regular people use. It's actually a pattern-matching language. If you've ever used wild card characters, you've had some experience with Regular Expressions. There's not enough space in this help page to make you an expert in Regular Expressions. If you do study Regular Expressions in another source, make sure you're using Regular Expressions for "Procmail' (the mail program on the server) rather than Unix or Linux. Perhaps some expressions and samples will help you catch on. Be warned, this is a very specialized field that is not common knowledge among our techs and the following items are not strongly supported.

Using the example above of "Save 50%", what if you get another email that reads, "Save 70%" or "Save 79%?. Instead of making 100 entries to cover most of the possibilities, you would edit the "Save 50%" to read "Save .*%". The period-asterisk combination mean "any character or characters". From now on, if I use {brackets} it means the meaning of the word in the brackets not the literal words. For instance, to type in {space}, meaning a space, you press that long horizontal key at the bottom of your keyboard. Therefore this entry now blocks any entry with the letters "Save" + {space} + {any character or characters} + "%". Be warned, this is a good filter for the subject line but not the body of the email because the body (or even the header) might contain "I thought this would save money but I'm just not 100% satisfied". Note that the entries are not case sensetive and this client who needs immediate attention may get lost in the shuffle.

Here's a quick and general tutorial on Regular Expressions.

A dot '.' matches any character except a newline. So, the expression

	.ob Jones

will match the string "Bob Jones", but also "Rob Jones" and "Qob Jones", too.

Any character followed by a star '*' matches that character repeated 0 or more times. Thus,

	Bob* Jones

matches "Bo Jones", "Bob Jones", or "Bobbbbbbbbbb Jones". The expression ".*" matches any number of unspecified characters.

Related are the '+' and '?' modifiers. The expression "a+" matches one or more a's. The expression "a?" matches zero or one a.

You can use parentheses to group an expression for use with a modifier. So, the expression

	B(ob)+

matches "Bob", and also "Bobobobobobob".

If one character in a pattern could be one of several, you can use a character class. For example:

	Part [abcd]

matches "Part a", "Part b", "Part c", and "Part d". If the first character of a class is '^', the class matches anything _not_ in the class. For example:

	[^aeiou]+

matches any series of one or more non-vowel characters.

One more operator is the '|' (vertical-bar) character. It is used to match either of two expressions. For example:

	Bob|Joe

will match "Bob" or "Joe".

The last two special characters I want to mention are '^' and '$'. Incidentially, here I'm referring to a '^' that isn't inside a character class. '^' means the beginning of a line, and '$' means the end of one. So,

Learning by example

One of the tricks used by spammers is to send HTML formatted email with links and pictures and other goodies. One work-around they've used to block filtering is the use of HTML <!-- comments --> that break up words like this. "To Unsub<!--comment-->scribe just cli<!--comment-->ck here!". When viewed in the browser the comments dissappear and the sentence looks like this, "To Unsubscribe just click here!". Now when someone screens for the word "Unsubscribe" or "Click Here" the search fails because SpamVault is looking at the source code of the email. Since normal people don't use HTML comments in their letter, why not search for comments themselves? Just make an entry like this "[<]--.*--[>]" and any email with hidden <!--{any characters}--> will be gone. Note: if the spammer uses a graphic button that reads, "click here" rather than an HTML text or input button, SpamVault will not read the graphic. As a general rule, always put your greater or less than <symbols> in square brackets like this [<] and [>]. Not doing so causes bad things to happen.

Another item to search for is the domain name within the source code of the email. Search for the @ symbol in the source code of the email and it will be followed by the domain name. Just use the "domainname.com" and not all the other stuff around it. So rather than blocking one address like someone@thespamnetwork.com, block everyone there by using "@thespamnetwork.com".

Many spammers use IP numbers as well. Just use the numbers themselves and not all the stuff around them. For example: 123.12.1.32.

And how about those emails that have "something silly for sale                 ie8383"? Let's use the above example to block a bunch of spaces followed by at least three characters. Use this:   "[<]             ...[]>". This blocks any subject with a bunch of spaces followed by at least three characters at the end.

Many people have requested that I provide a default list of blocks in every new install of SpamVault. However, not everyone wants to block the same email as I do. So, I've included the chart below which is a series of advanced filters that I use and you may find helpful by adding them to your entries in SpamVault. In the chart, the left column shows which part of the email this was designed for, H=header, F=from, T=to, S=subject, and B=body. As you'll see, the body is one of the strongest areas used to block spam. The collum on the right in bold is the entry you can put into SpamVault followed by a comment about this particular filter. Note the spaces, which are critical.

H	.*@.*@.*@.*@.*@.*@.*@
	Multiple CC'd names when someone CC's 7 or more people.
S	...
	Several spaces and 3 periods. Blocks a series of spaces followed by some characters in the subject line. "Something Silly for Sale         ei84477"
S	ADV: |<ADV >|^ADV.
	Several forms of ADV in the subject line. Make sure you put a space after it.
HS	00.*per day|00.*per week|00.*per month
	Block text like "Make 10,000 'per day' or 'per week' or 'per month'"
S	[0-9]*%
	Gets rid of text that contain a number then a %.  "50% off" and "Save 80%"
B	[<]http[:]//.*/remove/.*[>]
	Gets rid of any links which include a directory named "remove" somewhere in the link.
BS	HGH|H G H| H-G-H
	Several forms of HGH
B	MLM
	{Space}MLM{Space}. Multi Level Marketing
B	8.5.2.-.2.7.8.0.-.3.2.5.7
	This is a phone number that may or may not be spaced out. Phone numbers are a prime target because they're hard to change.
B	po Box 914
	Phone numbers, addresses work well
B	@%77%77%77
	The equivalent of www in an email address in the body. However the spammer tried to obvuscate it.
B	A HREF[=]3D
	This is a link with "3D" in it to stop spam blocking software from catching it. Some HTML email created with MS Outlook Express will have these in them so be careful because your friends might not be able to send their email through.
B	[<].*MARQUEE STYLE.*[>]
	Scrolling marquee usually created by MS Front Page and I don't know very many people who write their email in FrontPage.
B	opt.in email
	The words "optin or opt-in" email. Very few of my friends ask me to opt-in to their emails.
B	S. 1618
	Senate Bill S. 1618 never passed to allow spam but they sure like to quote it.
B	[/]mortgage[/]
	/mortgage/ subdirectory
B	[/]mothersday[/]
	/mothersday/ subdirectory popular in June.
SB	[0-9] year fixed
	Any year fixed mortgage
B	[0-9][0-9][0-9][0-9][0-9].com
	A link with several numbers in the domain name. "494938.com"
B	[<]href..http..[1-9][0-9][0-9].[0-9][0-9][0-9].*[>]
	A link that uses an IP address rather than a real domain name.
B	[<].*bgcolor=..000000.*font color=..000000.*[>]
	If your back ground color and your font color are black, you're hiding something.
B	[<].*content..Microsoft FrontPage.*[>]
	Any email created in Front Page is probably not worth reading anyway.
B	[<].*target?._blank.*[>]
	A link that pops open another browser window.
B	[<]ROWSPAN.*[>]|[<]COLSPAN.*[>]
	Column span or row span tags. When was the last time you put those in your email?
B	[<]SCRIPT LANGUAGE.*[>]
	Java Script in email
B	[<]TABLE=.*[>]
	Commonly used in legitimate emails so you may need to watch your logs and make entries to your white list if you wish to use this very effective entry.
B	[a-zA-Z][<]!--.*--[>][a-zA-Z]
	Comment in the mi<!--comment-->ddle of words.
B	[<]form.*[>]
	Never saw a form in an email that wasn't spam
B	[<]a href.*http[:]//.*mortgage.*[>]
	Any link with the word "mortgage" in it.
B	[ÿ£ÉÖÑÔ]
	Any of several forign characters
B	.com.br[^ a-zA-Z]
	End of a domain name from Brazil and not followed by a space or letter
B	[<].*font color???ffffff?.*[>]
	Tag for Font color white
B	v[^a-zA-Z]i[^a-zA-Z]a[^a-zA-Z]g[^a-zA-Z]r[^a-zA-Z]a
	Viagra broken up by non alpha characters such as comments or whatever.
B	[<]href=.http:.//*%.*%.*%/.*[>]
	Obfuscated url is always spam