Looking at my statistics, I find that two filters and CFS catch 93% of my SPAM:
My own "CRAP" filter - 62% (2 simple rules)
Invalid Header F/R/H - 16%
CFS - 15%

Does it make sense to rearrange my filters to "match" the "Top 10" sequence?

I find rearranging filters to be helpful. This aids in debugging a new filter (putting it at the top to see how effective it is). In "production" I have my "friendly" filter first to minimise false positives. This is followed by a junk filter with a zero false positive rate (so far). Last comes a filter which has triggered falsely.

Yes, I have only three filters.

The first two catch nearly everything they're supposed to.

Speed is another issue. If you know you have filters that run slowly, put them near the bottom so that the faster filters can "shortcircuit" them.

Please note that I'm not running the CFS-equipped beta, so if it implements filter order differently than the production version, my contribution may have little value to you.

I like this filter! Thanks for sharing. One question. What's the purpose of the trailing question mark? Since it comes after an "*" I'm not sure how it's treated. Also, why even bother having the [^;:]*? at the end anyway?

Al & TimeGhost I would be interested to see your filters. I have over 100 myself and would love to cut down that numbers.

Skah

The one filter that catches ~62% of my SPAM is set up to catch mail addressed to "old" email addresses, that I no longer use, but are still active.

Let me explain that. I have a dialup account that I use when on the road. I've had it "forever" and it must be on every SPAM list in the world, so any variaton on that is in my [C R A P] filter. The account is only used to get Web access, not email.

The other filter (16%) is one that came with the "set" available for download [Invalid Header ....]

Finally CFS (14%).

The remainder are pretty well what came with the "set". They account for the remaining 8%.

I get well over 300 SPAM emails per day.

HTH

Skah_T,

You are correct if you are thinking of a properly written "Received:from" line.

The problem is that a few of the forged "Received:from" lines are written so badly that this expression will not find a 'properly formatted' IP address in the line. When that happens, the expression does require the termination to keep from wasting any time by searching through the remainder of the header.

If you want to remove the terminator, feel free to do so. You may never receive an e-mail with the kind of forged line that causes the problem.

Skah_T,

Here is a link to another filter that you may find useful. This is the 'DIRECT to MX' fiter that I mentioned previously.

Most (almost all) of the SPAM that I receive is sent by the use of Bulk Maiking software that will bypass the sender ISP's outgoung mailserver and send directly to the recipients MX server. It's not perfect, but works pretty well at trapping SPAM.

It will require that you substitute the name of your ISP's own MX server in the expression, but you seem to have a good understanding of RegExp, so it will not be a problem for you.

Also....


Here is a link to the Internet Protocol v4 Address Space that lists the IP Address blocks used in the IANA-RESERVED filter.

You may want to check on this link periodically to ensure that the blocks in the filter are updated as required.



Note:

The following three blocks are reserved for private internets:

10.0.0.0 - 10.255.255.255 (10/8 prefix)
172.16.0.0 - 172.31.255.255 (172.16/12 prefix)
192.168.0.0 - 192.168.255.255 (192.168/16 prefix)

These may appear in legitimate headers (along with 127.0.0.1) and should not be included in the BLOCK list for the filter.

See RFC-1918

Thanks all. I may have to do an overhaul of my filters some time when I have a free day or two