Basic Spam Filtering

ISSUE:

Spam is a daily problem that is not just annoying, but is starting to effect everyday productivity for many people. WorldMail 3 helps to control SPAM by using WorldMail 3's Sieve Filtering technology and the new Anti-Spam engine by Active State.

SOLUTION:

WorldMail has integrated Active State's acclaimed anti-spam scanning engine into the new WorldMail 3 server. WorldMail 3 uses a multi solution approach to spam filtering; combining heuristics, profiles, keywords, white and black lists to offer very sensitive and accurate spam filtering. This approach offers the advantage of analyzing email and identifying spam during processing, before it is delivered to the user's inbox.

As the Active State anti-spam scanning engine analyzes messages, it calculates a spam score for each message based on techniques such as pattern matching, spam definitions, and heuristic analysis. Regular updates to the scanning engine heuristics ensure continued effectiveness against the changing tactics of spammers. The spam scores for each message can be used to determine how the message is handled by the system.

Spam Filter Rules for managing Spam.

In general, these rules should help curb the amount of SPAM targeted at your user base. The LOCAL mailbox filter can be entered via the WorldMail 3 console or the Eudora Web Client filters options, so a WorldMail 3 user can white list or reject at will.

Sometimes a message is tagged as a SPAM message for various reasons, even though the message itself is not a SPAM message per say. I can be a mailing list message or an automatically generated message from a service such as Ebay.

The SPAM engine takes into account if the message has the following typical SPAM criteria:

• FROM address ends in numbers

• The message header has X_PRIORITY and X_PRIORITY is set to HIGH

• The message was sent from an EXCHANGE_SERVER

• The message header has X_MAILER

• The message header has X_MSMAIL_PRIORITY_HIGH

• The message header has MSMAIL_PRI

• The message header is MISSING_MIMEOLE

• The message includes key SPAM words such as

  • FOR FREE

  • LOW PRICE

  • VIAGRA ONLINE

  • CLICK BELOW in capital letters

  • Link to an UNSUBSCRIBE page

  • A CLICK HERE link

• The message contains HTML_FONT_COLOR_RED or other COLORS

These results vary from message to message, but as you can see the method of determining a SPAM can sometimes cause a legitimate message to be counted as SPAM.

NOTE: In order to use header tagging, you need to have SIEVE filtering enabled for all inbound messages.

SERVER Receive filter

NAME: SPAM tag message

1. If SPAM SCORE is greater than or equal to 6

2. ADD a the SPAM score to the header

3. Add to the subject (optional) a SPAM SCORE

4. Continue filtering

SERVER Mailbox delivery filter

NAME: Spam Trap (default)

1. If SPAM SCORE is greater than or equal to 6

2. copy the message to Junk Mail (cannot be changed)

3. Continue filtering

LOCAL DOMAIN filter

NAME: variable

1. If SPAM SCORE is greater than or equals to 9

2. Discard.

3. Score of 9 or higher indicates a high probability of it being a SPAM, so it is best to discard it. You can reject it, but since most spammers forge the address, an innocent victim may get all the bounce backs and cause headaches for you and the other ISP

LOCAL Mailbox filter

NAME: variable

1. If FROM contains user@domain.com

2. MOVE message to INBOX (white listing)

KEYWORDS: WM3