Spam
I Want an Email Client-program that filters by
'first' 'Received-from' IP address
Spam
I Want an Email Client-program that filters by
|
|
(2008 Feb blog post --- preliminary ;
I will probably update the IP address info and add links)
|
My (spam) Battle I get a lot of spam. Some is from China and Korea, the Asia-Pacific area. Some is from other places like Chile and Romania --- and some is from the United States. In 2008, I am/was receiving mostly ads for meds. In 2007, I was also getting lots of mortgage re-financing spam and Rolex watch spam --- and the usual offers to enlarge that certain male member. My ISP provider (cox.net) filters out a lot of spam. But I still get about 20 spam emails per week (two to four per day). It's a real nuisance --- especially because I do not check my email sometimes for over a week, so I end up having to deal with about 20 spam messages. I can usually tell from the gobbledy-gook 'Subject' text --- and from the unfamiliar 'From' name --- which emails are spam. (I have to wonder who would respond to emails with such meaningless subject lines --- and gobbledy-gook in the message body to throw off mail filters that try to learn what to filter according to the message content.) Although most spam is recognizable from the Subject text, it would be a real time-saver to have a means to automatically direct such mail to a 'suspected-spam' mail folder. Some of the mail is particularly annoying because it is sent over and over and over again --- day after day --- even several times a day. I don't even want to see it. A SIDE NOTE: Unfortunately, I chose an email address of the form first-name-initial and last-name ... like sjones for Steve Jones. It seems spammers send out huge amounts of spam by attaching a single letter to a last name, from a huge list of last names. Hence I often see a spam email addressed not just to my email address but to several with the same first initial.
Example: sjohnson, sjohnston, sjones, sjorgenson Lesson to you: Do not pick an email address of that form. |
|
What I'd Like I would like to have an email client that filters out email by IP addresses --- in ranges --- such as all addresses in the range with 200.61.0.0 through 200.62.128.255, instead of by individual specific addresses like 200.61.23.42, or by individual mail sender addresses like sjones@att.net). I have described how a 'Received from' line in email 'header lines' can be used to determine a source IP address of an email. That description is in one of my external-web-links pages --- on the subject of computer-spam. Unfortunately, there are not many email clients that can filter on email header info --- specifically the 'bottom-most' 'Received from' IP-address in the headers of an email. The Microsoft mail clients (Outlook Express and Outlook) allow for filtering on keywords in the 'Subject' and 'From' and 'Body' fields. But spammers have pretty much made that kind of basic filtering useless. Most spammers use misspelled words for 'Subject' --- and, often, graphics images instead of text in the 'Body' --- and faked email addresses in 'From'. There is a web page at vdomainhosting.com that describes how one can set up Thunderbird to direct suspected spam to a probable-spam folder. In that description, one uses the Tools > Message Filters > New > Customize > Customize Headers path --- to specify a message header keyword to look for ... 'X-vDomHost-Relay'. That works if you use their vDomainHosting services. But for email from any ISP, ??? |
|
The following two images indicate the panels within Thunderbird where one would specify the filtering on individual IP addresses. If it turns out that Thunderbird will not do filtering on IP address ranges, using the IP address in the 'bottom-most' 'Received-from' header (and I don't think it does), I will have to look for another email-reader client --- or a helper application for an email-reader client.
|
|
Groundwork -- IP address ranges by country To start determining some IP address ranges to filter out, I have started a large list of IP-address ranges (along with some specific addresses). This file, on this site, shows ranges of IP addresses assigned to countries --- along with notes on some specific addresses and ranges that seem to be sources of spam and other undesirable net behavior (personal data gathering, spyware, viruses/trojan-horses/worms, adware, popups, etc.). My plan is to filter out email (and, also, eventually, block packets trying to enter the network card of my computer) that apparently comes from countries like China, Korea, Taiwan, Romania, Chile, etc. --- in fact, almost any country other than the U.S. About the only email I get is from friends using ISPs in the U.S. --- like cox, gmail, AOL, roadrunner, etc. Or I get email from businesses in the U.S. --- like travel agencies, my web host provider, etc. (Actually, I may want to filter out the mail from specific companies --- if they do not honor a request to stop further infomercial emails.) Many web pages indicate how difficult this IP-filtering approach is (namely, constantly finding new address ranges to filter out --- and then finding that some ranges may be too aggressive and need to be broken up). Example web pages are here (Bob's Block List = BBL) and here (a manager of a hiking supplies web site in Canada who is trying to allow only people in Canada and the U.S. to post comments on his web site). If you do web searches on this topic (keywords: spam filter "IP address" "block list" "black list" "white list" email ...), you will find many people that say filtering on IP addresses is not appropriate. Most of these people are system administrators who are filtering at routers or proxy servers or mail servers on a company network, and their company has a need to accept mail from many parts of the world. For example, my ISP (Internet Service Provider), cox.net, cannot filter out mail from China and Korea, because many of their customers may need to be able to receive mail from there. HOWEVER, I, as an individual, have no need for mail from China and Korea. I have no relatives or friends there. And even if I did have a relative or friend who was visiting foreign countries and sending emails to me --- I could simply check the 'From' column in my 'probable-spam' folder (where I would dump all spam-filtered email) to see if I got emails from friends. If I expected to receive more mail from them, I could add their email address or hostname (or an IP address) to a 'white-list' of addresses from which to always accept mail. |
|
I intend to add IP addresses/ranges to an IP list (like at the list-link above) --- as I check spam (and legitimate) email that I receive --- in order to prepare for the possibility of using an email client, like Thunderbird, to filter email by IP address ranges. Actually, it may be better to specify IP-address ranges from which to ACCEPT mail, rather than ranges from which to REJECT mail. If an email client would allow for that kind of filtering (via a "white-list" rather than a "black-list" --- i.e. via a list of addresses/ranges to ACCEPT rather than a list of addresses/ranges to REJECT), that would probably be the less maintenance-intensive way to go. Then I could simply specify U.S. IP address ranges that would accomodate senders of emails from my usual sources --- ISPs of relatives and friends (cox, gmail, yahoo, rocketmail, AOL, etc.), travle sites, investment sites, web hosting sites, and the like. |
|
In any case, I need some sites that provide information on ranges of addresses for countries (and companies). Here are some such sites.
|
|
A First-Octet IP-to-Country list For the first octet for an IP address (0 to 255), here is an overview of the countries (their country codes) that use IP addresses in each of those ranges of 256*256*256 = 16,777,216 addresses per each first-octet. Unfortunately, there was no apparent attempt, by the agencies that administer IP addresses and hostnames, to allocate the addresses in large, continguous chunks to each country. This should be a requirement for IP address assignments in the future. They could go by country-populations to assign large blocks by country --- holding blocks in reserve for future adjustments. This should be a requirement for the new ipV6 address structure.
I am in the process of indicating how the countries are scattered over these "1st-octet addresses". So far, I have done US, GB, JP, CN, DE, FR, CA, KR --- accounting for over 75% of the addresses. This information is assembled from the many 'slices' of IP addresses shown, by country/code, at ipmaster.org.)
|
|
|
|
|
|
|
|
White-list or Black-list ? (or both ? ) The list above is oriented toward specifying IP address ranges from which I expect to DENY mail. According to the ipmaster.org data, I would have to 'refine' the denial-ranges into many thousands (tens of thousands?) of tiny slices, to avoid squelching mail from desired sites/countries. So ... I plan to also collect ranges of addresses to accomodate various ISPs and companies from which I would expect to ALLOW mail.
No doubt I would have to 'widen' or 'add to' these allowance-ranges to avoid squelching mail from desired sites --- especially whenever they added an outgoing mail server whose IP address lay outside the ranges from which I was accepting mail. It is beginning to look like the best way to go would be to consider mail 'guilty until proven innocent' --- that is, to send mail to a 'suspected-spam' folder, UNLESS the 'first' 'Receive from' IP address (usually the 'bottom-most' IP address in the list of mail header lines) is in a "white-list" of addresses/ranges. I.e. it may be better to use a "white-list" than a "black-list", for my purposes. In any case, I would NOT use filters based on the IP-addresses/ranges to IMMEDIATELY DELETE incoming emails. I would automatically route mail from certain ranges of IP addresses to a probable-spam folder, which I would scan occasionally to see if any desirable mail was directed there. |
|
'PRIVATE' IP address ranges
As explained at this FAQ (at tech-faq.com), 'private' IP addresses are special, because they can be utilized over and over again on different networks. For example, two different companies can have 192.168.*.* networks at the same time. All home networks, 'behind' a router, use IP addresses in this range --- 192.168-prefixed addresses. The home router is typically 198.168.0.1, with addresses of the form 198.168.0.* for the PC(s) in the home. Private IP address ranges are considered non-routable. That is to say, private IP addresses cannot communicate on the Internet. Those addresses are used on company 'intranets' --- and Network Address Translation (NAT) is used to handle external connections, like routing of email. |
|
Bottom of page on blog topic Spam --
Looking for an Email Client
To return to a previously visited web page location, click on the
< Go to Top of Page, above. >
|
