Spam Marking Key

Currently, incoming email messages are processed for known spammers, and various words and phrases known to be used by spammers, as well as improper email configurations known to be used by spammers. Since some people want messages others consider SPAM and some non-spamming sites have misconfigured email systems, Wittenberg email users can select their own options through our quarantine system in the WittLink Portal.

This list is a "key" to the markings that appear in the quarantine system (To access, log into the WittLink Portal. You can tell why a particular message was marked as spam by checking the coding in the "Tags" column against this list.

• B - means it is on one of the Real-time Black Lists (RBL)
  A Real-time Black List is a list that is constantly updated with names and addresses of the latest spammers. Using these lists makes it easier because these lists are maintained by others who can spend more time working on the spam problem, thus taking some of the burden off the local staff. We currently are using spamhaus and njabl.
• S - means it failed a statistical filter
  The statistical filter uses a list of words, and each of the words is given a weight. If a mail message contains several of these listed words, the weights of those words are added together, and if they meet a certain value then the message is considered spam.
• K - means it contains a particular keyword or phrase
  This is a list of words that are known to be used in spam messages. This is the trickiest one to work with because what might be considered spam by one person may not be considered as such by others. This means we have to be careful as to what phrases and keywords are put on this listing.
• H - means it contains illegal HTML coding
  This means the e-mail message has some type of web-page (HTML) formatting that is considered bad or illegal. The best example of this is 'hidden' redirects. These are links that read like http://www.bank.com but underneath that is the hidden link that points to http://www.creditstealers.com . There are other tricks used by spammers to get you to go to their website, and this filter tries to make you aware of them by marking the message as H.
• U - means it is on one of the URL black lists
  This is a list of known web sites that appear in spam messages. If an e-mail contains a web-page link to http://www.creditstealers.com then this marker lets you know that the web site is considered a spam web site. This is different from the previous marker because this looks at the URL or link that is actually in the message, while the previous one looks at how the link is presented, or hidden.

This document last reviewed June 26, 2006.