Filter Update Time

Keeping SpamButcher's code base in top shape requires a lot of research. Every few weeks, the latest batch of confirmed "misses" has to be analyzed. The question is always the same, "why did SpamButcher miss this spam, and what can be done to catch it?"

In reality, some spam is always going to be missed. However, most of the time the mail sender leaves a few telling signs. These clues are often common across a large percentage of all junk mail, and it makes sense to include them in anti-spam software's rule set.

While it's not realistic to keep up with every new spam campaign that sends out a few million messages, a lot of the campaigns are worth tracking down.

Many messages are readily detectable as belonging to a certain campaign due to their use of a certain phrase. These messages can be tracked historically by checking newsgroup archives for their presence. Surprisingly, some of the same spam email messages have been being sent for several years. Adding these phrases to SpamButcher's filter makes sense, as presumably the spam campaigns will continue indefinitely.

Smarter spammers are pretty good at fooling most filters. They do this by intentionally crafting messages that obfuscate or hide common indicators that they are junk.

Some spam-friendly websites actually allow you to test mails against various filters to see if they are blocked. If the spam "passes" - the odds of it being delivered to people's inboxes is good. This kind of service could of course be used legitimately for senders of newsletters or other genuinely-wanted bulk email messages. I recently performed such testing for a design firm in the Seattle area wanting to send email to clients inviting them to their open-house.

Some anti-spam websites like SpamAssassin Rules Emporium offer sets of spam filtering rules for download. These rules are mainly geared towards server-side solutions running on Linux. While this can help system administrators stop spam email, there is the very real concern that it allows spammers to know exactly what methods are being used to block their messages on a large portion of servers.

Back