Filter Update!

We just finished yet another rolling filter update. The filter hasn't missed a single message targeted at our main "test account" in about 12 hours. During that time, it caught about 300 junk messages. It's not realistic to expect this performance to keep up, but clearly a lot of progress has been made.

So what's in the latest revision of everyones favorite tool to filter junk email?

As always, we find a handful of phrases commonly used by spammers and target those. These phrases "add up" - making the filter more accurate.

We also nailed several specific spam campaigns. These filter additions don't target spam in general, but only go after specific campaigns. One example of this is watching for certain misspellings commonly used by a certain "adult content" spammer.

Surprisingly, some of these campaigns seem to span years. The Usenet can be a very valuable tool in researching a spammer's history.

We've also done a little network topology research. It turns out some areas of the internet are disproportionately responsible for spam email, but almost never send legitimate messages.

Another observation turned into code was that spam mailers tend to send emails using certain "X-mailers" or "User Agents." These headers indicate what program was used to compose and send the email. It makes sense a spam sending application wouldn't list itself as "Email Spam Software 5.0."

A lot of the spam sending applications are somewhat dated, and it shows. Sometimes they pretend to be a version of an email application dating back to 2001. Realistically, it's a lot more likely for an email with such a header to be from a spam-app as opposed to a legitimate user.

As always, these filter data points are only a few factors among thousands that dictate if an email is filtered or not.

Back