| More than 50% of all e-mail on the internet today is Unsolicited Commercial Email (UCE, more known as spam). The main problem with spam compared to traditional forms of advertising is that you as the receiver pay for it all with disk space, bandwidth and above all - employees that spend their time cleaning inboxes when they could do more productive things.
 Since sending spam costs spammers close to nothing, they only need to close a deal on 1 of 100.000 messages sent to make a profit.
Messagewash™ uses the very latest technology to determine whether a message is spam or not. Messagewash™ detects more than 95% of all spam with default parameters.
 Combined with the possibility to define personal black- and whitelists makes this the best spamfilter available today.
Messagewash™ uses a multi-level spam filtering approach where every message goes through seven stages before being marked as spam or not.
Seven stages of spam filtering:
Personal Whitelist
Email addresses, domains, ip addresses or network blocks can be trusted.
Trusted objects will never be considered spam.
Personal Blacklist
Email addresses, domains, ip addresses or network blocks can be blacklisted.
Blacklisted objects will always be considered spam.
Heuristic analysis
Each message is put through more than 1100 individual tests. This includes header and subject analysis, along with detailed tests of the message body such as URLs, font colors used, typical sales pitches and much, much more.
DNS-based blacklists
If someone sends a large number of spam messages through a dialup account, an open proxy or through a hacked computer - chances are his IP address, domain or netblock will be registered on a blacklist.
Messagewash™ checks every message against more than 20 publically available blacklists to help determine if the message is spam or not.
Checksums
Messagewash™ uses three different types of checksum tests on each message. The checksums are generated from live spam getting reported to publically available checksum servers.
Messagewash™ has a large number of email addresses whose only purpose is to collect spam. Traps like these are often known as honeypots.
Since the honeypots get no legitimate email, email collected here is then fed back into checksum servers. Spammers are interested in sending their messages to as many recipients as possible, and have no way of knowing if an address is a honeypot or not.
Bayesian filtering
Bayesian filtering is an old statistical algorithm which can be applied to email messages when trying to determine if it is spam or not. It is also a system that learns over time. The more email your domain gets, the more accurate the filter becomes. See Paul Graham's paper for more detailed information.
Greylisting *NEW*
Greylisting is a technique where the combination of sender email address, sender ip-address and receiving email address isn't accepted unless certain conditions are met. See Evan Harris's paper for more detailed information.
Spam or not Spam?
When a message is passing through the different stages it starts out with a spam score of zero. Whenever a test signals that the message might be spam it also adds to the message's total spam score. Once the message has passed through all the tests above, and if its total spam score is above a certain parameter - the message is judged to be spam. No single stage (except personal blacklists) is enough to tag a message as spam, an approach which generates very few false positives. (less than 0.2% with default settings)
 You may also decide what to do with the spam: Tag it and forward to the recipient, forward to your administrator for manual inspection or delete the message.
Who is sending all this spam? Check out ROKSO, an excellent source of information.
|
