Spam Analysis

Overview

This is a brief introduction to the Spam analysis page and the actions you can take there.

One way to detect Spam is to look for similar messages that are posted to multiple lists. The analysis page shows the results of tallying emails by various header fields, including Subject, From and ReturnPath. For example, if a particular Subject is seen on multiple lists, this is quite likely to be spam, similarly for the other header fields.

Note that the entries in the columns are independent of each other. An email which matches an entry in a particular column generally won't match the entry in the corresponding row in other columns. This is because spam emails often vary some of their headers; e.g. they make subtle changes to the Subject whilst keeping the same From: header.

URL options

Various qualifiers can be added to the default URL https://webmod.apache.org/spamalyse.html?action=spamalyse

oldest=n

Show pending emails no older than n days. Can also specify hours, e.g. oldest=4h Current default is 20 days

minimum=n

minimum count to show; current default 20

showCooked

Decode the Raw columns. This only affects the tallies; the matching messages are always shown decoded.

skipSpam=1

Ignore pending requests already marked as spam by anyone. Note that this only applies to the counts that are shown; when a value is selected, all pending mails are shown. This helps confirm that the value really is associated with spam. The setting is mainly intended to make it easier to mark obvious spam.

For example: https://webmod.apache.org/spamalyse.html?action=spamalyse&minimum=5&skipSpam=1

Possible actions

Clicking on an entry will show all the messages which match that header (you might have to scroll down the page). Clicking on a message will show an extract of the message. You can also view the message text, source and html.

There are checkboxes on the left for selecting messages, and a button to flag all selected entries as spam. Note: this skips messages which have already been marked by you, so reselecting them won't slow down reporting.

Please take especial care when selecting messages by SenderIP24. This includes a range of IP addresses, and it is easy for spam emails to swamp the genuine ones. It is best to use one of the other selectors.

FromHost

The host(domain) part of the From address

FromRaw

The full From address header value (intended for help in devising Regex filters)

ReplyToHost

The host(domain) part of the ReplyTo address

ReplyToRaw

The full ReplyTo address header value (intended for help in devising Regex filters)

ReturnPath

The ReturnPath (enveloper sender). This is what is used by ezmlm to identify senders, not the From address.

ReturnPathHost

The host(domain) part of the ReturnPath.

SenderIP

The IP address of the sender. This may be shared by multiple senders.

SenderIP24

SenderIP, masked to 24 bits. This represents a block of 256 IP addresses, generally served by a single provider. Some providers are not very diligent about preventing spam (or may indeed facilitate it). But it is very easy for ham to get mixed in with the spam. SenderIP24 is mainly intended for use by Infra in devising mail filters for persistent spammers.