How SpamButcher Really Works

At last count, SpamButcher's filter was made up of roughly 12,000 different rules.

Each rule inside SpamButcher indicates if a message looks more like spam or less like spam.

Here are a few actual rules from inside SpamButcher's source code:

I won't give away specifics - but let's say for the case of argument a score of about 1600 is needed to trigger the email filtering code to intercept a message. The exact number depends on a series of other factors that I'm going to avoid discussing (we keep a few secrets around here).

The first example is pretty obvious. The phrase "third party offer" seems to appear in about one out of every dozen spam messages. At the same time, it's not entirely unreasonable that it may periodically occur in a good message. So, it gets a score of 500.

The next example contains an excerpt from a commonly used scam letter template. That particular phrase is unlikely to occur in natural language, but yet has been landed in people's inbox thousands if not millions of times. A score of "3000" means that the message is going to get nixed.

The last example is little tougher to figure out. No, we don't block all messages from AOL users. AOL 5.0 is nearly a decade old at this point. I'll venture to say almost no one is running AOL 5.0 at this point.

Yet, at least one common spam sending software package that generates fake message headers commonly spoofs itself as being "AOL 5.0" for some reason. My theory is that the mailer software in question is actually quite old - and is probably circulating around various file-sharing sites. If you're free - you don't have to be good.

So, when SpamButcher sees "AOL 5.0" in the message headers - it knows there's a good chance something is wrong - and gives it 400 points. Messages from other seriously obsolete email clients get treated similarly. They generally don't trigger enough points to cause the spam catcher to render a final judgment against them - but it's often enough to put a message "over the top" when combined with other criteria.

Rules aren't just limited to text phrases. They can include factors like if an email was sent from a dial-up IP address, or from a known "problem" network. If a message was sent to you and two-dozen Yahoo! addresses - it will have some points added to its score.

Messages with attached GIF files, or contain extensive use of HTML tables get some points added. Messages which appear to have "hidden text" (white text on a white background) also get points tacked on.

In addition to "positive rules", SpamButcher employs some rules with negative scores. These rules indicate that a message is less likely to be a spam message. I won't list any of these rules here - as there's the strong potential for them to be abused if they fall into the wrong hands.

Back