A frequent question users ask is how to block foreign spam:
I'm receiving email that looks like it comes from Russia (funny looking letters). I keep adding the addresses to my block senders list however I seem to be getting more and more of them. I would like to make a rule to just delete them all, but I cannot find the letters anywhere to type into the rule.Can we make a rule in which Outlook can auto-delete any emails that contain Asian characters
Sure, you can create a rule to delete messages containing these (and other) character sets. You can also set the junk filter to delete mail that uses certain character sets.
But first, I'll address the use of the blocked list: Don't bother adding spammers to it. Because most spammers use an address once, you're only filling up the list with bad addresses. The blocked list should be nearly empty. Use the Safe lists to whitelist addresses as needed.
Junk Email Options
If you use Outlook 2003 or newer, you can set the Junk email option to filter mail either by the top-level domain or character set. If you don't correspond with users in certain high spam countries or who would be using alternate character sets, you can configure Outlook to filter all messages from the top level domain or that use foreign character sets.
Open the Junk Email Options dialog and go to the International tab. Block most of the encodings, but not ASCII or Western European, possibly not Latin 3 and 9 and any others that would be used by people from other countries that you correspond with.
Note: If the message (spam) doesn't have a character set in the header, this filter won't work.
The lines in the message header will look something like either of these two lines:
Content-Type: text/plain; charset="ISO-8859-1"
Content-Language: en-us
The top level domain list blocks mail sent from addresses ending in a two-character country code (.de, .us, .ru etc). Because most spammers use .com addresses, this filter is less useful.
Find the Junk Email Dialog:
In Outlook 2010 and newer, the Junk email options is Home ribbon in any mail folder; in Outlook 2003 and 2007, look on the Tools, Options dialog.
Note that Outlook 2010 and newer maintains a separate junk mail settings for each account.
If you have multiple accounts and deliver the mail to different Inboxes, select an Inbox and review the junk mail settings, then repeat for each Inbox. If you use one Inbox, select a message from one account and review the settings, then select a message from another account and check the settings.
Create a Rule for Foreign Spam
Users of all versions of Outlook can create rules that look for foreign characters in message bodies. Copy a few of the most common characters from a spam message and paste them into a rule. You only need about 8 to 10 letters from each language for maximum spam filtering.
To create a rule
First, locate a message with the characters you want to filter on and copy one or more characters.
- Open Rules Wizard. In Outlook 2010 and newer, look for Manage Rules & Alerts on the Home ribbon, Move section, under the Rules button. In Outlook 2007 and earlier, Rules & Alerts is on the Tools menu.
- Click Add Rule.
- Choose Apply rule on messages I receive near the bottom of the dialog.
- Click Next to move to the Conditions screen.
- Select the "with specific words in the subject or body" condition.
- Click on "specific words" in the lower part of the dialog and paste the characters in the Specify words... field. Click Add. If you copied multiple characters, delete all but one character, then click Add. Repeat until all characters are added.
- Click Next to move to the Actions screen.
- Select "delete it" and click Next. At this point, the rule should look something like the rule shown in the screenshot.
- Click Next if you want to add exceptions to the rule or run it on messages in your Inbox, otherwise, click Finish to return to the Rules Wizard dialog.
Block Foreign Spam in Outlook on the web
As with the Outlook for windows desktop version, you can use rules in Outlook on the web to look for foreign characters in the subject or message bodies. Copy a few of the most common characters from a spam message and paste them into a rule. You only need about 8 to 10 letters from each language for maximum spam filtering.
These steps always work in new Outlook that replaces Windows Mail, but only if you are using an Outlook.com or Microsoft 365 Work or School account.
To create a rule
Open a message with the characters you want to filter on in a new window. Copy one character or word to start.
- Click on the View tab > View Settings button.
- Select Mail on the left, then Junk email page.
- Click Add New Rule.
- Choose Subject or body includes in the Condition menu.
- Click in the "Enter words to look for" field and paste the characters, one at a time, in the field. Press Enter after each character or word is added.
- Copy another character or word and paste in the field and press enter. Repeat as needed.
- Click on the actions menu and choose what you want to do with messages that meet the conditions in the rule.
- Select Stop processing more rules. (If you don't enable Stop Processing, a copy of the spam may be left in the Inbox.)
- Click Next if you want to add exceptions to the rule or run it on messages in your Inbox, otherwise, click Save.
Your rule should look something like this:
More Information
- Add EU to the International Blocked TLD List
- Automatically Cleanup Outlook's Deleted Item and Junk Email Folders
- Blocking Mail From New Top-Level Domains
- Bulk Add Addresses to Safe and Blocked Senders Lists
- Don't Get Caught In a Phishing Hack
- Empty Multiple Deleted Items Folders using a Macro
- Icon is not correct on the Junk Mail Folder
- Junk Email Filtering isn't Working in Outlook
- Junk Mail Filtering in Outlook
- Office 365 Fraud Detection Checks
- Outlook's "Not Junk" option isn't available
- Rules and Tools to Filter Junk Mail
- Samsung smartphones move email to the Junk folder
- Sending Autoreplies to Spammers
- Should You Respond to Junk Mail?
- Understanding the Safe and Blocked Senders lists
- Using Outlook's Junk Filter with Multiple Accounts
- Using Outlook's Junk Mail filter
- What Moved a Message to the Junk E-mail Folder?
temnp says
I do not even understand how I ended up here, but I assumed this publish used to be great
STEVE says
And it dose not work with the latest version PAID GOOD MONEY to block all these scamming junk .Have put blocks on all countries but still coming from USA. They send it with out any way off blocking it some say i sent it a load off CRAP
fla says
It dos not work with outlook 2016. Maybe the spammers use better technology which overcome the filters.
Diane Poremsky says
Which method were you trying? They should all work - but the international options relay on information in the header, which may be wrong.
Rae says
Thank you, this really helped. I couldn't figure out the setting to block characters. After checking out your screen captures I found it easy to change. I had unsubscribed to a few different websites, unfortunately right after I did, I was bombarded with over 200 emails in less than 24 hours - all containing characters I could not block with Outlook. Instead I had to block all countries except U.S.
Brenda W says
The junk mail filter (rule) instruction above does not allow me to copy and paste the foreign characters appearing in the body of the email. The emails (often coming in) have very long domain names in English characters, a from name appearing in maybe Russian characters with a sub ordication name that is similar but different. These are always 3 characters. The body character look Japanese of Chinese yet some look like something made up / picture like. I do not know how to list them in the specific words in a rule becuase I cannot form them from my keyboard and have no idea what they mean. I know is is junk or spam or phishing. Getting several a week and some days 2 ro 3. Can you give me some instructions to help. Using Outlook 2016 desktop and have 6 email account I should write a rule for of this type. Thanks for any help you can offer me.
Diane Poremsky says
You can't select (and copy0 them in the message? That is the easiest way to create the rule as most people don't know how to recreate the characters. After copying, paste into the rule.
Keith says
Highlight the character in the email and click it and click copy. In the Rules windows, in Outlook, click in the blank and the press ctrl+v that will paste. I like to use ctrl+c for copy and ctrl+v for paste. For some reason, outlook rules do not allow you to use the Paste, instead use ctrl+v
Ron says
Hello, this stuff is really interesting! However, is there a way to filter outgoing messages on outlook? I want to be sure that no emails containing a specific language (not English), will be sent by mistake. I appreciate your reply.
Diane Poremsky says
There isn't a way built into outlook but can create an 'after sending' rule to look or specific words in the subject or body using the method in the Create a Rule for Foreign Spam section. I'd probably hold the message for the max time (120 min) rather than delete it.
Deb says
On October 3 2013 you indicated you can filter all non-com and non-net domains. Is there a way to do this in one command - where only emails from .com, .net domains are received and all others are blocked??
Diane Poremsky says
Ah... i think it would be easiest to use a run a script run that checked the urls. A plain rule would be able to check for the presence of https:// and add exceptions for .com and .net, but it wouldn't be very accurate (it would look anywhere, including in addresses in the body). A run a script rule could use regex to check the url. Better would be to use an antispam scanner that filtered out urls.
Deb says
Hi...a while back yiu says you can filter all non-com and non-net URLs...how do you do this in outlook. 100% of my spam come from these and I want to block them all. Thanks!!
Diane Poremsky says
Did i say URLs or addresses? I didn't see where i said it in these comments (but maybe i skimmed them too quickly). I don't recall saying it and need to refresh my memory.
You can block address in the Junk email filter, international settings.
Allan says
FYI Diane,
I think Yahoo is doing all they can to force users into buying their "Premium" email service by doing little or nothing to stop these Spammers.
Same Spammers, over and over again are attacking user's inboxes, even though they are reported as Spam.
As a footnote, you might, just for giggles, open a new Yahoo email account and see for yourself where I'm coming from.
MAYBE, with all your wisdom, you can find a way to stop these Spammers, on Yahoo at least(-;
Allan
Allan says
Diane, in Yahoo email Filtering, there is no "International tab", the junk mail filter tab includes:
Filter Name
From
To/CC
Subject
Body
Then Move The Message to....
Please remember, I don't have/use Outlook, and I have standard Yahoo email.
Diane Poremsky says
Oh... I misunderstood. Yeah, your options are limited when you use web access - if Yahoo doesn't support it, you won't be able to filter on it.
Allan says
Not sure what a "character set" is. The emails are all in English. Please excuse me, but what is a "rule?"
Diane Poremsky says
On the International tab of the Junk mail filter, you can block character sets; you don't want to filter us-ascii or western European but can block several others.
A Rule processes messages as they arrive - the second part half of the article shows how to create a rule that looks for words in the body.
Allan says
Diane, I'm not a user of Outlook and I use Yahoo standard email.
Here lately I'm getting virtually thousands of spam emails with an ISP I traced back to China, the emails are in English. ALL these spam emails ISP's begin with 116.
Other than reporting the emails as spam, which I've done so much, my fingers are raw, is there ANY other way of stopping these spam emails?
Thanks,
Diane Poremsky says
What character set is used? The junk filter has an option to block by character sets.
You can try a rule for 'with words in the header' - but you need to make this as unique as possible to avoid filtering good mail accidently. Using "[116." might not be unique enough (the bracket will avoid filtering within an IP address.)
Dale says
Worked...thanks.
Dale says
Hi Diane, I've pretty much given up on trying to block spam. They've started adding numbers to the end of the "Subject" line and changing them.
I have another problem and don't know where to post it. I tried on the WD Elements forum but haven't received a response.
Before my laptop crashed last week I did a backup on my WD Elements hard drive. Now I want to put this info on my new computer, but not sure how. When I drill down to the backup info it is listed as "Backup files 1", "Backup files 2" and so on through "Backup files 190".
My questions are as follows:
1. Can I just do a "Restore" in my Control Panel and tell it to use that data, or do I need to open Windows Explorer and drill down in each Backup file and drag and drop where I want it?
2. I have saved new documents in my "Documents" under Libraries (which is where the bulk of my backed up info needs to go). Will either a "Restore" or drag and drop effect the new documents? I can save these few new files to a flash drive if necessary.
Diane Poremsky says
Sorry I missed this earlier - I'm trying to get caught up after taking most of Dec off. :) I'm not familiar with that backup software, but with other backups, yes, you would use the restore program. Some programs will mount the backups and you can browse to find specific files. Restore shouldn't affect existing files - as long as they have different file names. If the file names are the same, the new file may be overwritten.
Dale says
I did what you said with the "Windows-1252. I haven't had any spam from .info or .tk since - not even in my junk box or deleted file. I can't tell if this is stopping it before it hits my webmail at Road Runner, or if I'm just not getting any spam right now.
Dale says
That doesn't seem to help either. Maybe I'm telling the rule to look in the wrong place for the .info.(?) I'll try to past the wording below from the email when I click on "Message Options". (I took out my email address and replaced it with asterisks.
Return-Path:
Received: from cdptpa-pub-iedge-vip.email.rr.com ([107.14.174.245])
by cdptpa-fep11.email.rr.com
(InterMail vM.8.04.01.13 201-2343-100-167-20131028) with ESMTP
id
for ; Wed, 29 Oct 2014 20:11:31 +0000
Return-Path:
Received: from [84.239.57.231] ([84.239.57.231:62377] helo=Ayresmith.ndBreakfastShow.C.8S.com)
by cdptpa-iedge09 (envelope-from )
(ecelerity 3.5.0.35861 r(Momo-dev:tip)) with ESMTP
id 31/80-10686-2F941545; Wed, 29 Oct 2014 20:11:31 +0000
Date: Wed, 29 Oct 2014 20:11:29 -0000
From: "=?ISO-8859-15?B?X1dpbmRvdyBEaXNjb3VudHM=?="
Subject: =?Windows-1252?B?UXVhbGl0eaBXaW5kb3dfUmVwbGFjZW1lbnQuRGVhbHNf?=
MIME-Version: 1.0
Content-Type:
multipart/alternative; boundary="SaI6111-IJ-1757323-676=_!"
Message-ID:
X-RR-Connecting-IP: 107.14.168.141:25
X-Authority-Analysis: v=2.1 cv=GrbM+yFC c=1 sm=1 tr=0 a=K61abTOxmzkdaQiVxOMUpA==:117 a=K61abTOxmzkdaQiVxOMUpA==:17 a=ayC55rCoAAAA:8 a=0oj8HZZGiqAA:10 a=9cW_t1CCXrUA:10 a=jPJDawAOAc8A:10 a=13Gyjc2-_UYruZWFdh0A:9
X-Cloudmark-Score: 0
X-EsetId: 37303A29E3E9CF636D7162
Diane Poremsky says
This is the problem:
From: "=?ISO-8859-15?B?X1dpbmRvdyBEaXNjb3VudHM=?="
Subject: =?Windows-1252?B?UXVhbGl0eaBXaW5kb3dfUmVwbGFjZW1lbnQuRGVhbHNf?=
it's encoded because of the character set (ISO-8850-15). Unless there is something else unique to filter on, a rule is not going to work. Hmmm. If they all use the same charset, one of two things might work - if you don't get legit mail from that charset, create a rule to delete mail with Windows-1252 or ISO-8850-15 in the header. (I'd set a rule to set a category on the mail, to see if any legit mail uses it.) You could also try to filter on a partial string from the end of the from field - like VudHM=?=" (check the header of several messages from info addresses and see which characters always match). However, that might not work since its at the end of the string, not the beginning.
Dale says
I'll try that, thanks. It seems like 90% of my spam comes from .info - 5% from .tk, and the rest from .com and/or .net.
I'll let you know if that works.
Dale says
Not sure what an "addin" is. Yes, the message is just like the dialog you show.
Diane Poremsky says
An addin is a utility installed in outlook so you can do something that outlook normally cant do. the list of addins should be at tools, trust center, addins. that dialog shoildnt move mail out of the junk folder. try changing the rule to move the mail to the deleted folder and see if it works better.
Dale says
I created a rule in Outlook 2007 to move any email with .info in the header to the junk email file. Sometimes it won't work, then other times it will move it there, display the notice that it's downloaded an apparent spam email. When I click "ok" it moves the email from the junk file to my inbox. ????
Bill Guidera says
I may have misread or misunderstood earlier posts. But for these common spams, since I do not see anything in the To: line, creating a rule by checking the option "where my name is not in the To box" then "delete it" then "except with @ in the recipients' address", correct?
Diane Poremsky says
That should work - i'd use to or cc field and run a test for a few days where a category is added so you can see if it's working correctly as a lot of bulk mail and mailings put your address in the BCC.
Barry Foate says
"At this time there is no built-in way to block them, but you could use a rule that looks for .club> in the header."
Diane Poremsky says
Ah... I was looking only at the article and the pending comments page and didn't see my comment with the typo. :) Yes, that was a typo and its fixed now. Thanks. Sorry about that.
dennis says
I changed the international language settings, but it isn't saved permanently. How can I get it to be permanent?
Alan Striegel says
What mechanism (if any) is there for blocking by some of the new top-level domains that I'm starting to see as sending addresses?
For example, quite a bit of the spam I'm seeing lately comes from domains that end in .club.
Diane Poremsky says
At this time there is no built-in way to block them, but you could use a rule that looks for .club in the header.
A run a script rule is another option, but the words in the header rule should work.
Barry Foate says
Diane,
Does the entry have to be entered exactly as you show (with ">" at the end)? If so, what is the function of that symbol?
Diane Poremsky says
That sounds like a typo. (Is that on this page? I didn't see it.)
Maisy says
Hi Diane, When I copy the symbol (which I can't copy and paste here as it wont allow it) it shows up differently after I add it in the search list box and you cannot break it apart from the symbol. This spam cannot be stopped by Verizon, it also enters my junk box and removes itself back to the inbox. I am also seeing domains in my safe senders list. The one thing I would like to do which is consistent with all of them is there is nothing in the TO: field. I don't see how to block it in outlook. I am told it might be in the bcc field. I can send you some samples which will blow your mind. Otherwise, I tried to do what you say and it simply wont let me have just one symbol and it always contains the domain address which changes with each email (so obviously it would be a waste of my time which is what they want). I am going out of my mind with trying to block these. They have figured out all the ways you can block a spam email and countered it. Thanks
Diane Poremsky says
Hmmm. I thought i answered this one. :( You can use a rule that looks for @ in the To field to filter out messages with To address. Well, it would actually be 'apply to all messages Except if @ in recipients address' Test it with flags or categories first to make sure it works as expected and doesn't delete mail you want to keep.
PapaGolf says
Next step - block email with an embedded LINK to a foreign country?
Diane Poremsky says
That is difficult to impossible. While you could filter all non-com, non-net urls, you'd need to do a DNS lookup on every url to insure they were not based outside the us. There are smtp filters that do this sort of thing - often based on url blacklists. I think the spam filters from both mcafee and Norton do this.
PapaGolf says
I may be out of my league here, but in Outlook (and other programs) the link has an embedded address. Just mouse over and it pops up. No need for a DNS lookup unless you needed to verify something. That's how I do a quick determination of bogus email now manually.
Diane Poremsky says
Correct, you can do that manually, but to do it automatically (or remove the link), you need to use a script (or addin) and check the source code.
ereemst says
Great article, but now one to you how do i block russian spam with cyrillic letters in Exchange 2013 with spam options on if i block a cyrillic letter A its just gives ? as return
Diane Poremsky says
That would indicate a problem with the character set. does it change to ? as soon as you enter it/save it or after you close and reopen the dialog?
NN says
Tried all this but outlook will not let me paste the characters.
Diane Poremsky says
Did you use Ctrl+V to paste?
jigneshhrathod says
Thank you! This was so helpful. I was really tired of getting junk emails written in some Chinese languages. I didn't think of any solution. Thanks a lot for the simple solution.