# Example Sieve Script
# Author: SanjaySheth
# URL: http://wiki.fastmail.fm/index.php?title=SanjaySieveSpamFilter
require "fileinto";
if anyof (
# Blacklisted sender domains
header :contains ["from", "Received", "X-Sender", "Sender",
"To","CC","Subject","X-Mail-from"]
[ "123greetings", "allfreewebsite.com",
"new-fields.com","atlasrewards","azogle.com",
"bannerport.net","bettingextreme.com","bigemailoffers.com",
"BlingMail.com",
"beyondoffers.net", ".biz ", ".biz]",
"cavalrymail.com","ciol.com","citywire.co.uk",
"cosmicclick.com",
"consumergamblingreport","creativemailoffers.com","creativeoffers.com",
"daily-promotions.com",
"dailypromo.","dailypromotions.",
"dandyoffers","dlbdirect",
"e54.org", "email-specials.net","email-ware.com","emailoffersondemand",
"emailbargain.com","emailofferz","emailrewardz","etoll.net","emailvalues.com",
"evaluemarketing.com","exitrequest.com",
"fantastic-bargain.com","fpsamplesmail.com","freelotto",
"findtv.com", "freddysfabulousfinds.com",
"genuinerewards.com",
"hotdailydeal.com","hulamediamail","hy-e.net",
"inboxbargains.com","idealemail.com",
"jackpot.com","jpmailer.com",
"lolita","lund.com.br",
"mafgroup.com","mailasia.com","mailtonic.net","migada.com","ms83.com",
"nationaloffers.com","nexdeals.com ",
"offercatch.com","offermagnet.com","offerservice.net","offertime.com",
"offersdaily.net","optnetwork.net",
"ombramarketing.com","on-line-offers.com","outblaze.com",
"permissionpass","primetimedirect.net","productsontheweb.net",
"rapid-e.net","recessionspecials", "redmoss","remit2india",
"sampleoffers.com","savingsmansion.com","sendoutmail.com","simpleoffers.com",
"specialdailydeals4u.com","Select-Point.net",
"speedyvalues.com","sportsoffers","sporttime.info","suntekglobal.com",
"superstorespecials.com", "synapseconnect","sunsetterawnings.com",
"thefreesamplenews","truemail.net",
"ub-kool","ultimatesports.info","uniquemailoffers","utopiad.com",
"unixlovers.net",
"valuesdirect","virtualoffers.net",
"wagerzine", "webdpoffrz",
"yestshirt.com",
"z-offer.com", "zipido.com"
],
# Blacklisted ip subnets due to excessive spam from them
header :contains "Received"
[ "[4.63.221.224",
"[24.244.141.112",
"[61.171.253.177",
"[63.123.149.", "[63.209.206.", "(63.233.30.73", "[63.251.200.",
"[64.41.183.","[64.49.250.", "[64.57.188.", "[64.57.221.",
"[64.62.204.",
"[64.70.17.", "[64.70.44.", "[64.70.53.",
"[64.39.27.6", "[64.39.27.7","[64.191.25.","[64.191.36.",
"[64.191.9.",
"[64.125.181.", "[64.191.123.", "[64.191.23.", "[64.239.182.",
"[65.211.3.",
"[66.46.150.", "[66.62.162.", "[66.118.170.", "[66.129.124.",
"[66.205.217.", "[66.216.111.", "[66.239.204.",
"[67.86.69.",
"[80.34.206.", "[80.80.98.",
"[81.72.233.13",
"[128.242.120.",
"[157.238.18",
"[168.234.195.18]",
"[193.253.198.57",
"[194.25.83.1",
"[200.24.129.", "[200.161.203.",
"[202.164.182.76]","[202.57.69.116",
"[203.19.220.","[203.22.104.","[203.22.105.",
"[204.188.52.",
"[205.153.154.203",
"[206.26.195.", "[206.154.33.","[206.169.178",
"[207.142.3.",
"[208.46.5.","[208.187.",
"[209.164.27.","[209.236.",
"[210.90.75.129]",
"[211.101.138.199","[211.185.7.125]","[211.239.231.",
"[212.240.95.",
"[213.47.250.139", "[213.225.61.",
"[216.22.79.","[216.39.115.","[216.99.240.",
"[216.126.32.", "[216.187.123.","[217.36.124.53",
"[218.145.25","[218.52.71.103","[218.158.136.115",
"[218.160.42.74", "[218.242.112.4]"
],
# Blacklisted SpamAssassin flags
header :contains ["SPAM", "X-Spam-hits"]
["ADDRESSES_ON_CD","ACT_NOW","ADULT_SITE", "ALL_CAP_PORN",
"AMATEUR_PORN", "AS_SEEN_ON",
"BAD_CREDIT", "BALANCE_FOR_LONG_20K", "BARELY_LEGAL", "BEEN_TURNED_DOWN",
"BANG_GUARANTEE", "BANG_MONEY","BASE64_ENC_TEXT",
"BAYES_99","BAYES_90",
"BE_BOSS", "BEST_PORN", "BULK_EMAIL",
"CASINO", "CONSOLIDATE_DEBT", "COPY_ACCURATELY", "COPY_DVD",
"DIET", "DO_IT_TODAY","DOMAIN_4U2",
"EMAIL_MARKETING","EMAIL_ROT13", "EXPECT_TO_EARN","EARN_MONEY",
"FIND_ANYTHING", "FORGED_AOL_RCVD",
"FORGED_HOTMAIL_RCVD", "FORGED_YAHOO_RCVD",
"FORGED_RCVD_TRAIL", "FORGED_JUNO_RCVD",
"FORGED_MUA_",
"FREE_MONEY","FREE_PORN",
"GENTLE_FEROCITY", "GET_PAID", "GUARANTEED_STUFF", "GUARANTEED_100_PERCENT",
"HAIR_LOSS", "HIDDEN_ASSETS", "HGH,", "HOME_EMPLOYMENT","HOT_NASTY","HTTP_ESCAPED_HOST",
"HTTP_USERNAME_USED","HTML_FONT_INVISIBLE",
"IMPOTENCE","INVALID_MSGID","INVESTMENT",
"LESBIAN","LIVE_PORN","LOSE_POUNDS",
"MARKETING_PARTNERS", "MORTGAGE_OBFU", "MORTGAGE_RATES",
"NIGERIAN_SCAM", "NIGERIAN_TRANSACTION_1", "NIGERIAN_BODY", "NUMERIC_HTTP_ADDR",
"NO_MX_FOR_FROM","NO_DNS_FOR_FROM",
"OBFUSCATING_COMMENT", "ONLINE_PHARMACY",
"PENIS_ENLARGE",
"PREST_NON_ACCREDITED", "PURE_PROFIT","PORN_4",
"RCVD_IN_DSBL", "RCVD_IN_OSIRUSOFT_COM","RCVD_IN_BL_SPAMCOP_NET", "RCVD_IN_SBL",
"RCVD_IN_MULTIHOP_DSBL", "RCVD_IN_RELAYS_ORDB_ORG", "RCVD_IN_UNCONFIRMED_DSBL",
"RCVD_FAKE_HELO_DOTCOM", "RCVD_IN_RFCI", "RCVD_IN_NJABL","RCVD_IN_SORBS",
"REFINANCE", "REVERSE_AGING",
"SAVE_ON_INSURANCE","SPAM_REDIRECTOR", "STOCK_ALERT", "STOCK_PICK", "STRONG_BUY",
"SEE_FOR_YOURSELF", "SUPPLIES_LIMITED",
"THE_BEST_RATE","TONER",
"UNSECURED_CREDIT",
"VACATION_SCAM", "VIAGRA", "VJESTIKA",
"WHILE_SUPPLIES", "WORK_AT_HOME",
"X_OSIRU_DUL", "X_OSIRU_SPAMWARE_SITE", "X_OSIRU_SPAM_SRC"
],
# Blacklisted subjects
header :contains ["From","Subject"]
[" penis ",
"ADV:", "adult dvd", "adult movie", "adultdirect", "adultemail",
"background check", "bankrupt", "boobs", "business opportunity","big@boss.com",
"casino", "cash guarantee",
"debt free", "diet bread", "ebay secrets", "erection",
"financial freedom", "free credit",
"gambl", "gov grants", "jackpot",
"life insurance", "lottery", "lotto",
"mortgage", "nude", "OTCBB",
"penis", "porn", "promotion", "proven System",
" rape ",
" sex ", "skin resurfacing", "special offer",
"ultimate software", "viagra", "V1AGRA", "vivatrim",
"win money","work from home", "xxx"
],
# often spam emails to multiple addresses with same name & different domain
header :matches ["To","CC"]
["*fastmail*fastmail*fastmail*fastmail*fastmail*"],
# Almost all emails from these domains is spam (at least for me)
header :contains ["from", "received"]
[".ru ",".jp ", ".kr ", ".pt ",".pl ",".at ",".cz ",
".ru>",".jp>", ".kr>", ".pt>", ".pl>",".at>",".cz>"],
# Really high SpamAssassin scores (15.0+)
header :matches ["X-Spam-score","X-Remote-Spam-score"] [
"1?.?", "2?.?", "3?.?", "4?.?", "5?.?", "6?.?" # 10.0 to 69.9
]
) {
fileinto "INBOX.Spam.discard";
stop;
}