Date: Wed, 29 Jan 2003 21:17:38 -0500 (EST)
From: "Keith F. Lynch" <kfl at KeithLynch.net>
To: WSFAList at KeithLynch.net
Subject: [WSFA] Re: Nigerian Letters
Reply-To: WSFA members <WSFAlist at keithlynch.net>

Ivy Yap <yapivy at techemail.com> wrote:
> Wow, all this talk of spam and letters from Nigeria.  I think I've
> gotten less than 10 spam messages since I started using e-mail.
> I feel unloved! ;)

Your email address has apparently never appeared in any newsgroup
posting, on any public web page, or anywhere else that spammers
scrounge addresses from.

> And where's all the porn spam that people keep complaining about?
> How come I never get any? :D

How many would you like?  I have plenty I'm not using.

Like Rich, I currently get far more Spanish Prisoner ("Nigerian") spam
than "four reports" chain letters.  But this may be because the latter
are far more stereotypical, thus easier to filter out.  The "Nigerian"
ones tend to all be slightly different.  The ones that are actually
*from* Nigeria can easily be blocked.  I discard everything from that
country or from Argentina, China, Korea, and Taiwan, as those are all
major source of spam, and seem to have few if any non-spammer email
users.

As of a year and a half ago, I had received over a hundred thousand
spams from those countries, and not one single non-spam.  Since then,
my filters have blocked more than another hundred thousand emails from
those countries, and I assume all of them were spams.

I currently average about half an hour a day updating my filters.
Whenever a spam slips through, which fifty to a hundred do each day,
I try to find a rule which would have blocked them.  Then I make sure
that rule would not have blocked even one non-spam email in the past
five years.  Including every one of the 3800 messages posted to this
list over the past year.

Simply blocking everything containing the word "Nigeria" is obviously
unacceptable, since it would have blocked this discussion thread,
among much else.  But if any of you were to start quoting chunks of
text from actual spams, your posting might get filtered, so watch out.

The one filtering rule I use that I know has caused false positives is
blocking all HTML email.  Unfortunately, I really have no alternative,
as that stops more spams than all other rules put together.  (Over
200,000 spams blocked in the past year.)  And since HTML email can
spread viruses, worms, and web bugs.
--
Keith F. Lynch - kfl at keithlynch.net - http://keithlynch.net/
I always welcome replies to my e-mail, postings, and web pages, but
unsolicited bulk e-mail (spam) is not acceptable.  Please do not send me
HTML, "rich text," or attachments, as all such email is discarded unread.