The Blue Water Spam Filtering Process

Unwanted email has moved from being a nuisance to an escalating problem, especially for businesses. Spam reduces employees’ productivity, introduces potential legal liability, and can increase IT expense. Blue Water utilizes three layers of protection to detect and act on suspected spam.

1. Blacklisting:

Blue Water uses a proprietary blacklist. Most commercial blacklists such as MAPS and ORBZ/S, use a “guilty until proven innocent” approach, often blocking email from legitimate senders. Our blacklist contains ONLY addresses of the most egregious spammers, and blocks over five percent of inbound spam.

2. Fingerprinting:

Messages are fingerprinted to detect matches with known spam characteristics. Fingerprinting removes variable items from the message (i.e. spacing, salutations, encoding, etc.) and compresses the message into its core content. Messages identified as spam are “fingerprinted” and given a unique id based on their content. If this “fingerprint” is detected in our database, the message is marked as spam. Our fingerprinting technology aggregates data from all spam we block, allowing the fingerprinting process to become more effective over time. Our fingerprinting database blocks nearly 10 percent of inbound spam.

3. Rules-based scoring:

Blue Water assigns scores to messages based on more than 13,000 unique characteristics of spam and legitimate email. When a message’s score reaches a defined threshold, it is flagged as spam.
Message characteristics we evaluate and score include:
• Phrases in the body and subject of the message
• Header Formation (i.e., Message-ID, Received, random characters)
• Originating mail server and mail agent
• From and SMTP From address
Our rules-based scoring filter blocks over 95 percent of inbound spam with false positives at 1 in 10,000 emails.