Webroot's Email Security System spam filtering module currently filters over 99% of all spam with a false positive rate of approximately only 1:300,000. These rating have been independently tested by West Coast Labs in their test report conducted in January 2007.

Online Quarantine

Emails that are classified as spam are automatically quarantined and kept on the system for 28 days. During this 28 day window, the administrator(s) can login to the online portal where the spam emails can be previewed and released if required.

The anti-spam service works by processing the email through a number of filters:

Central spam Monitoring System (Level 1)

Every email that passes through the spam filter has a unique signature value created. These values are locally checked against an internal database of current spam attacks; if a match occurs then the email is classed as spam. If the value does not trigger, then the email it is sent to a Central spam Monitoring System (CSMS). The CSMS analyzes data it receives and looks for similar emails being sent in bulk over a short time frame. When such an email is spotted, further tests are performed, and based on this the system decides if the email is spam or a legitimate mailer. If it is spam, then the value is propagated out globally to all of the email filtering system mail relays.

Collective spam Reporting (Level 2)

This spam filtering method is Collective spam Reporting (CSR). Emails that multiple end users report as spam are broken down to a signature value and dealt with as Level 1.

Open Relay Server Check (Level 3)

This filter makes use of a global black list database of known open relay servers.

Real Time Black Lists (Level 5)

A global black list database of IP addresses of known sources of spam.

Senders Address Check (VS)

A check is made to see if the senders email address is valid.

Custom Rules

‘Explicit’ spam filtering is implemented by means of ‘rules’. E.g., a rule that says ‘quarantine all mail that contains the word “HGH” in the subject’ is an explicit declaration of a spam definition.

Black and White Lists

The system can be configured to block or allow email from defined email addresses or domains.

Downloadable Documents