diff --git a/modules/services/mail/default.nix b/modules/services/mail/default.nix
index 27b8291c..890649d1 100644
--- a/modules/services/mail/default.nix
+++ b/modules/services/mail/default.nix
@@ -86,6 +86,26 @@ in
       dkimKeyDirectory = "${config.chvp.dataPrefix}/var/dkim";
     };
 
+    services.dovecot2.sieveScripts = {
+      after2 = pkgs.writeText "custom-spam.sieve" ''
+        require ["fileinto", "regex"];
+
+        if anyof(address :is "From" ["junjunggaming07@gmail.com",
+                             "censysnetbackup@gmail.com",
+                             "vitor.carvalheiro@escola.pr.gov.br",
+                             "spam@vuztc.ru",
+                             # itsme spam
+                             "noreply.mailing.itsme@online.be",
+                             "mailing.itsme@online.be"],
+         # Freshdesk is often used to sent spam from emails like `support@info5813.freshdesk.com`
+         address :regex "From" "[a-z\d]+@[a-z\d]+\.freshdesk\.com",
+         header :contains "From" ["jakubbielec", "Jakub Bielec"]) {
+            fileinto "Junk";
+            stop;
+        }
+      '';
+    };
+
     services.rspamd.extraConfig = ''
       actions {
         reject = null;