URL Links

[marke]

One of the objectives of the spammers, is to get you to visit their site, or to make email contact with them.

Blacklisting their email address is not particularly effective as they are constantly sending from a different address, usually an address borrowed from one of their victims, or a fabricated address.

If you apply filters based on the URL Links in the body of the email, I have found that this is very effective, rejecting 34% of spam with bodyURL based filtering.

I have body links filters that I constantly update. I have these filters set to auto delete, and everytime I find another URL link in a spam message that is not filtered by other means, I add that address to the filter.

 

Here are two of my body link filters:

http://[^"<>]*?[.]?(abhorredresolve.com|again7.com|adlikeegg.info|affordablegenericdrugs.com|allkindsa\.info|allmalenatural.biz|american-novelty.com|awesomesoft.biz|bastapharma\.biz|bolkan.biz|ammishaddaiurbane.com|at4c.biz|best-loan-search.biz|betterspot.ne|betweenpoints.com|blue-net-offers.com|butinfact.com|buymeripren.biz|carlz.us|carderplanet.com|ccs56g.com|ccqw44.com|cdsforyou.biz|cheapcheapills.com|chimpwue8.com|cialagenius.biz|clickquick.biz|com4dsd.com|cooltvoffers.biz|creditcard2003.com|daddymack.biz|datasend\.biz|dia99.biz|doctor45.com|doctorapproval.net|dubnh.us|.dynmede3.com|econsumerdeals.com|editiondw.com|effectivebeauty.com|ehostzzz.net|eosadsjsfjb\.biz|extraosadsjsfjb\.biz|fast-loan-search.biz|fastmed.biz|featurexgold\.biz|fightnottobesingle.com|firstquote\.biz|fisha.biz|freeadultranch.com|freedomwaverider.com|freedomconcourse\.com|geegles.com|getinfohere\.com|gitawey.com|gono.us|goodoffering.biz|goosadsjsfjb\.biz|greatestoffers.biz|greatpharm2.com|guaranteedpills.com|healthcolon.com|hetmial.com|hfg3\.biz|hormenkirdan.com|horty.biz|htdihost.com|HugeCrush.com|hulio222\.com|ihavepills.com|iwbd.biz|jotpies.com|KARAOKECLUB.RU|keepthepeaceprocess.pro.br|landlocked.napsterr.biz|linksss.com|lookingforasinglewoman.com|lotsofmed.com|makelover.us|meds-discount.com|meds-on-sale.com|meds-sold-online.com|meds-the-great.com|meercx.com|myrxplace.biz)

http://[^"<>]*?[.]?(nodebtatall\.biz|oem\-biz\.biz|oem\-box\.biz|oem4all\.biz|oilupherbutthole\.com|onlinenetshop\.biz|openseed\.biz|paylesscanadiandrugs\.com|perfectserver\.biz|PetCareRX\.com|phannerclak\.com|pharmacourt\.biz|pharmacy\.8800\.org|poetry\.com|poienade\.biz|popularpills\.com|pouvr1\.biz|procitravin\.com|prosize\-health\.biz|prosizehg\.biz|pushbuttonpromos\.com|pxp\.add5r5df\.com|qazwsx\.biz|quick\-home\-loan\-search\.biz|quickforms\.biz|remote\-cars1\.com|rxonline|rxperfectmeds\.biz|rxplace\.biz|rxprovider\.net|rx\-world\.biz|rx357\.com|saleinlin3dd\.com|seeingnoone\.com|sex[\d]*?\.net|shoprxanytime\.com|seeingnoone\.com|shorncompanies\.com|skylife\.co\.kr|softforlive\.biz|specialhealthdeals\.biz|swttangel\.com|swissdrugs\.com|symbol4e\.com|theteenhunters\.com|tellahost\.com|thisisthetime\.pro\.br|this\-helps\-4\-u\.com|topsafe\.biz|triplegold\.biz|triplegold\.info|truevaluemeds\.biz|vcv3dsx\.com|wsntv7511\.com|yhnujm\.biz|yourout\.net|yourremedy\.biz|yxmeds\.com|zazi\.net)

Both of these filters are set to auto delete, and are added with the "body contains regular expression" settings.

 

Best regards,