Print Page | Close Window

New User - One question

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6057
Printed Date: 12 December 2025 at 5:59pm


Topic: New User - One question
Posted By: IKILLSPAM1
Subject: New User - One question
Date Posted: 02 May 2007 at 5:08pm

Hey people, I started this out by looking for a way to get good reporting on what emails I was blocking via blacklists etc.. And when that didnt work, I figured maybe a front end application which passed the email through while doing some basic filtering, would then provide me with good stats.. Its weird but somehow I came across your product and have been test driving it on a few domains I host. I must say Im impressed. The quarantine table alone gives me exactly the data I needed to report on. We've been trying to extract that data from our maillogs and its been a pain trying to get the developers going on it.

Anyways, how does the SFDB database work? We get ALOT of spam and block alot. Do I have to do anything to offer up IPs to be included in this DB or are you somehow pulling them from me?

Cant think of anything else right now.


THanks




Replies:
Posted By: LogSat
Date Posted: 02 May 2007 at 8:06pm
The evaluation version of SpamFilter only queries the SFDB database, we do not allow it to report any data to it. Only licensed copies of SpamFilter are able to update the SFDB. In short, it works as follows:

Everytime an IP sends a spam email to SpamFilter, SpamFilter will report that IP to our SFDB in realtime.

When we receive a certain number of reports from several different companies running SpamFilter within a short period of time, at that point the IP will be blacklisted. The IP is automatically removed from the SFDB within 24 hours as soon as the malicious activity reported has either stopped or fell below our thresholds.

Since we must receive multiple reports from multiple of our "sensors" throughout the internet in a short period of time, and all happens in realtime, the SFDB filter is extremely accurate in listing only IPs that are indeed sending spam.


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Posted By: IKILLSPAM1
Date Posted: 03 May 2007 at 10:51am

"Everytime an IP sends a spam email to SpamFilter, SpamFilter will report that IP to our SFDB in realtime."

So if I have it set SFDB checks for IPs blocked by all filters, does that mean if an email got blocked by SF due to it being on a dns blacklist I am using, then that IP also gets added to the SFDB? Wouldnt that be doubling the effort?

What about when I block an email because its in China? Does that IP get added to the SFDB?

Sorry if these sound like stupid questions, just want to be clear on it. Statisticly, the SFDB is blocking the most emails so thats a good thing :)



Posted By: IKILLSPAM1
Date Posted: 03 May 2007 at 10:54am

Also, you said it happens in realtime, so SF somehow over the internet, updates the SFDB? How exactly is that taking place? Sounds almost like you could have a copy of the email transaction if you wanted to.

Thanks again.



Posted By: LogSat
Date Posted: 03 May 2007 at 4:32pm
Actually we don't have, and neither want a copyu of the email! All SpamFilter reports is the IP being blocked, and the ID number of the filter that caused the blocking. That's all we need to make everything works. Yes, this happens in realtime, the counter you see on our website navigatoin bar is the current number of blocked IPs at that time.

Originally posted by IKILLSPAM1 IKILLSPAM1 wrote:


So if I have it set SFDB checks for IPs blocked by all filters, does that mean if an email got blocked by SF due to it being on a dns blacklist I am using, then that IP also gets added to the SFDB? Wouldnt that be doubling the effort

Not really. Different companies can be using different blacklists first of all. Furthermore, the SFDB is much more dynamic than blacklists. If the IP stops sending spam, it's removed from the SFDB within hours, not days.

Originally posted by IKILLSPAM1 IKILLSPAM1 wrote:

What about when I block an email because its in China? Does that IP get added to the SFDB?

No. You would just be adding one single report for that IP address. If other SpamFilter installations throughout the world also receive email from that IP, and their filters (not the SFDB, as it's not blacklisted there yet...) *also* tag the email as spam, then yes, the IP will get listed in the SFDB if there's enough reports we receive in a short period of time.


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP



Print Page | Close Window