Is it safe to assume that most, if not all, emails from a *.ru domain may be considered spam? From a log of 30000 emails from *.ru, its all been spam (over two months).

  • 6
    It depends. I've had for a long time 100% working spam filter that everything in English was spam.
    – user9850
    Jul 18, 2012 at 14:56
  • 1
    @lechlukasz - that filter would cause me problems - I could effectively use the reverse of that as my first pass, as I don't get any useful email that is not in English :-)
    – Rory Alsop
    Jul 18, 2012 at 15:13
  • 1
    Have you considered using DNSBL and URIBL?
    – Matrix
    Jul 18, 2012 at 18:14
  • 1
    Worth pointing out that a .ru domain does not mean a Russian IP, nor vice-versa.
    – tylerl
    Jul 19, 2012 at 1:58
  • 1
    Can you exclude any possibility that some "normal" non-spam mail would come from Russia? If yes, you may ignore and filter away the totality of the mail traffic from there. Otherwise you would need a more fine approach.
    – user34567
    Nov 23, 2013 at 10:33

4 Answers 4


No, you cannot safely assume this. Maybe according to your mail servers you can assume this, but overall only 4.9% of total spam comes from Russia according to Trustwave.

According to Securelist the number is as low as 1.7% for January 2012.

See this picture for how far down Russia is placed on the spam list: Kapersky Lab

Inda: 11.6%
Indonesia: 8.1%
South Korea: 7.7%
Brazil: 7.6%
Peru: 3.9%
Vietnam: 3.5%
Italy: 3.2%
Great Britain: 3.2%
Poland: 3.0%
Argentina: 2.7%
Colombia: 2.4%
Taiwan: 2.4%
Kazakhstan: 2.0%
France: 2.0%
Spain: 1.9%
USA: 1.8%
Russia: 1.7%
Saudi Arabia: 1.5%
Romania: 1.3%
the Philippines: 1.3%
Other: 27.3%

Edit: additional info.

If you sometime have to do business with a Russian you would have a bug that may be hard to identify later on, perhaps in a couple of years when you forgot about this configuration. Russia is the 9th largest country population wise in the entire world so it may be quite a big deal to block it.

I would look at the spam designated to you and see if you can identify any common denominators in the headers or content of the spam. There may very well be other ways to distinguish between the spam and no spam than blocking everything.

  • 26
    To be sure...although only 4.9% of spam comes from Russia, it may well be that 99% of Russian mail is spam. Your chart doesn't show that aspect of it. Jul 18, 2012 at 14:38
  • 36
    -1 for propagating mathematical illiteracy. The percentage we're interested in is the percentage of Russian mail that is spam (though even that might be irrelevant). However, the percentage of spam that is Russian mail has absolutely nothing to do with anything. Jul 18, 2012 at 17:20
  • 16
    @Karrax: You still don't seem to get it: this has nothing to do with language vs origin. OP is asking if most mail from Russia can be ignored as spam. Your answer tells us whether most spam is from Russia. That is the answer to a completely different question, and does not help at all in answering OP's question. It could very well be the case that most spam comes from Russian mail, but most Russian mail is not spam; or, it could very well be that comparatively little spam comes from Russia, but most mail from Russia is spam anyways. This answer has nothing to do with the question!! Jul 18, 2012 at 18:26
  • 19
    +1 to @BlueRaja-DannyPflughoeft and mathematical illiteracy. The answer to "is drowning fatal?" has nothing to do with "only 0.01% of deaths are due to drowning"
    – Jimmy
    Jul 18, 2012 at 18:38
  • 7
    i would downvote this answer if i had enough rep on security.se
    – jasonk
    Apr 2, 2013 at 2:17

Server-side filters for mail are a much better solution. Start with a couple of really good DNSRBLs and then add SPF checking. Also, make sure your host isn't an open relay using the various tools around the Internet. Finally, set up a system (e.g. 'fail2ban') that will automatically block IP addresses at the 'iptables' level for a deterministic amount of time when they attempt to log into hosted services and fail repeatedly. This approach lets automated software handle blocking of bad mail at the originating source that you never really wanted to get in the first place - and will block the *.ru spam in the process while letting legitimate mail through.

After doing these things on my server, I saw a 99% drop in my incoming spam for my e-mail client. The rest of the inbound spam is dealt with by setting up a few simple client filters. You can, again, choose to block *.ru at this level but that is up to you. If you don't care about Russia or know anyone there, then block away but spammers always find new ways around generic blocks like that, so you'll be fighting a losing battle.


It might be that 99.99% of your mails are from a .ru domain.

However wether you can block it depends on the 0.01% that are not spam. What do you want to do with them and most importantly what does it cost you to lose that message.

If this is a local site for an area in another country far away from Russia then it might be a small inconvenience to you and you lose contact with someone. However if you are a site covering a more widespread are and say need to do business in Russia losing these emails might have a measurable cost in reputation if not money. In this case I think you have to ask the business owner how much it would cost to lose that contact and also tell them how much it would save to filter out the .ru domain an let them make a business decision.


I would assess based on where and how you conduct your business communication. If you never conduct business outside of the United States, then I would block all other traffic. I have done this for several small and medium-sized companies and I've yet to be called back on having to make an exception for an international address.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .