How SpamFilter ISP Works

SpamFilter ISP's strength lies in the large number of filters that are applied to detect spam. Below is a partial list of some of the various filters that are employed to stop spam.

SFDB - Spam Filter Distributed Blacklist Database

The SFDB filter has been developed exclusively by LogSat Software. This filter uses a very powerful resource to stop spam: The entire global SpamFilter ISP user community.

This latest filter is proving to be one of the most effective and accurate tools in stopping spam.
Anytime a company running SpamFilter ISP blocks an email, the sender's IP address is sent to our centralized SFDB database. This allows the SFDB filter to have access to a huge repository of spammer's IPs, updated in real-time by all the SpamFilter ISP installations in the world.
Our database analyzes this data in realtime, and will block IPs that have sent excessive amounts of spam to multiple locations in the world in the spam of the previous few minutes. This allows the SFDB to be extremely accurate, effective, and to start blacklisting IPs within minutes of them sending spam.
IP addresses from the database are automatically aged and removed from the database within 6-24 hours if they stop sending spam and/or viruses.

SFDC - SpamFilter Distributed Content Database

The SFDC (SpamFilter Distributed Content) filter is the latest filtering technology developed by LogSat Software.

When SpamFilter ISP receives an email, it will analyze the email's contents and will calculate a 20-byte hash to characterize it. We developed technology that is able to detect similar emails based on their contents. SpamFilter will assign the same hash to similar emails. When SpamFilter detects that emails with the same hash signature are originating from several different locations, it will report such anomaly to our centralized servers.

Our database analyzes, in real-time, this incoming flow of messages, and, based on their quantity, origin and destinations, is able to detect what signature hashes are generated by spam emails.

The technology behind the SFDC allows our centralized database to detect spam signatures regardless of the email's text and contents, but rather base it on the patterns used by spammers to deliver their emails.

Detection of spam signatures in images

SpamFilter ISP contains proprietary technology developed by LogSat Software that scans images embedded in emails for spam content. 

We at LogSat Software were the first, in June 2007, to develop technology that allowed SpamFilter to scan images embedded in PDF files for spam content (the so-called PDF spams).

RBL and SURBL Blacklists

Spam Filter ISP can check any user-specified RBL blacklist to see if the sender's IP address is being blacklisted. Reliability can be improved by requiring an IP to be blacklisted by two or more RBL servers for it to be marked as spam.

Spam Filter will analyze all URLs specified in the email body itself, and will check any user-specified SURBL blacklist server to see if the URL in the email is being used to host spam-related websites.

Greylisting

Greylisting is not an anti-spam filter itself. More specifically, greylisting takes advantage of a required behavior by the RFCs that some anti-spam products use to greatly reduce the amount of spam received.

In the majority of the cases, when a "spam bot" computer is used to send spam, it will do so by sending huge amounts of emails in the fastest way possible. If a recipient's SMTP server does not respond, chances are that the spam bot will ignore such server and move on.

Luckily this behavior by spammers is in direct violation of the RFCs that dictate how email works. The RFCs require that, if an initial attempt to deliver an email fails, the sender must retry to send it.

Greylisting takes advantage of this by initially denying every connection attempt from an IP address. Only after a certain, small amount of time is the remote IP allowed to connect. If the sender is a spam bot, it is very likely that said IP will never retry to connect again, and so it will not even try to send spam. If the sender is a legitimate server, they will be following the RFC guidelines, and within a few minutes they will retry sending the email, which will be then delivered.

SpamFilter ISP v4 and higher support greylisting, and we at LogSat Software have made some changes in the implementation of this method to reduce the amount of delays that occur when a server connects for the first time to SpamFilter.

Bayesian statistical DNA fingerprinting

Spam Filter ISP performs statistical DNA fingerprinting on all incoming emails. This bayesian filter is self-learning, continuously analyzing your incoming traffic to improve its accuracy with time.

SSL and SMTP Authentication

Many mail servers lack support for SSL and SMTP Authentication. SpamFilter ISP supports both SSL and SMTP AUTH via Active Directory, LDAP, and Unix-style password files. If a user is authenticated, they will be able to bypass all filtering rules and use SpamFilter ISP as a relay to send their outgoing emails.

Administrators can then add support for SMTP Authentication (and SSL) if they have older mail servers that do not have these features.

SPF - Sender Policy Framework

SPF fights email address forgery and makes it easier to identify spam, worms, and viruses. SPF is an open source standard that is emerging as a solution to prevent spammers from using fake email addresses. Domain owners identify sending mail servers in DNS. SpamFilter ISP verifies the envelope sender address against this information, and can distinguish legitimate mail from spam before any message data is transmitted

Block Emails from User-Defined Countries

SpamFilter ISP is able to block emails being sent from any user-specified country. In addition, SpamFilter will track and record the number of email attempts made from all countries. This allows administrators to determine, visually, if there are any countries they do not wish to receive emails from.

...and dozens of more filters!

In addition to the filter specified in other sections of the website, SpamFilter ISP supports several more filters that can be used to detect spam.

A partial list is below.

  • Local IP Blacklist - Our SPAM Filter server checks if the remote server's IP address matches an entry in your local IP blacklist file, the email is rejected.
  • Local Domain Blacklist - The SPAM Filter gateway checks if the domain portion in the sender's email address is in your local domain blacklist file, the email is also rejected.
  • Local FROM EMail Blacklist - The sender's email address is checked against your local list of blacklisted email addresses. If present, it is rejected.
  • Local TO EMail Blacklist - The recipient's email address is checked against your local list of blacklisted email addresses. If present, it is rejected.
  • Attachment Blocking - SPAM Filter can check emails for specific attachments or attachment extensions. If found, the email is rejected.
  • Keyword Content Filtering - Our SPAM Filtering software can check email content and subject for specific keyword and/or phrases. If found, the email is rejected.
  • Honeypot Emails - You can have a list of "honeypot" email addresses. Any email sent to an address in the list will cause the sender's IP to be blacklisted.
  • Connections can be rejected if the remote server does not have a reverse DNS PTR entry.
  • Spam Filter is able to check if the sender's MX DNS record is valid before accepting email.
  • Refuse connections if there are too many spaces in the subject line.
  • Max Recipients in single session - Use this setting to limit how many RCPT TO commands can be issued in a single session.
  • Max Email Size - Incoming emails can be blocked if they exceed a certain size.
  • Reject if Empty "Mail From" - If this option is checked SPAMFilter will reject all emails with an empty "Mail From" field.
  • Reject if "Mail From" = "Mail To" - Reject all emails where the sender's email is the same as the recipient's email.
  • Reject if "From Domain" = "To Domain" - SPAM Filter can reject all email where the sender's domain is the same as the recipient's domain.
  • Tag Spam & Deliver - Allows to tag spam by adding the header "X-SF-SPAM:Y" to email classified as spam. The email is then forwarded to the destination SMTP server. This allows administrators to handle spam as they wish on the back-end.
  • Tag Spam in Subject & Deliver - Allows to tag spam by prefixing the word SPAM: in the subject line of emails classified as spam. The email is then forwarded to the destination SMTP server. This allows administrators to handle spam as they wish on the back-end.

Spam Filter ISP - Copyright © 2002-2008 LogSat Software LLC - PO BOX 916340 Longwood, FL 32791 USA

 Sales: sales@LogSat.com - Support: support@LogSat.com - Tel. (sales only): +1 407-650-3008