Internet Security

Detecting spam by phrases and addresses. Creating lists

You can create lists of allowed, blocked and obscene key phrases as well as lists of allowed and blocked sender addresses and the list of your addresses. If these lists are used, Anti-Spam analyzes every message to check if it contains the phrases added to the lists and the addresses of mail sender and recipients to check if they match the records in address lists. Once the sought phrase or address is found, Anti-Spam identifies such message as useful mail or spam depending upon the list where the phrase or address is present.

The following mail will be recognized as spam:

• messages containing blocked or obscene phrases with total weighting coefficient exceeding 100;
• messages sent from a blocked address or not addressed to you directly.

The following messages will be recognized as useful mail:

• messages containing allowed phrases;
• messages sent from an allowed address.

Masks for key phrases and sender addresses

You can use phrase masks in the lists of allowed, blocked and obscene phrases. The lists of allowed and blocked addresses, and the list of trusted addresses support address masks.

Mask is a template string that a phrase or an address is compared against. Certain symbols in a mask are used to represent others: * substitutes any sequence of characters, ? – any single character. If a mask uses such wildcards, it can match several phrases or addresses (see examples).

If the * or ? character is a part of the sought phrase (e.g., What’s the time?), it should be preceded with the  \ character to ensure that Anti-Spam recognizes it correctly. Thus, instead of the * character you should use in masks the \* combination, the ? character should be represented as \? (e.g., What’s the time\?).

Sample phrase masks:

• Visit our * – this mask corresponds to a message that begins with the words Visit our and continues with any text.

Examples of address masks:

• admin@test.com – the mask only matches the address admin@test.com.
• admin@* – the mask matches the sender address with the admin name, for example, admin@test.com, admin@example.org.
• *@test* – the mask matches the address of any message sender from a domain beginning with test, for example: admin@test.com, info@test.org.
• info.*@test.??? – this mask corresponds to the address of any sender whose name begins with info. and whose mail domain name begins with test. and ends with any three characters, for example: info.product@test.com, info.company@test.org, not info.product@test.ru.