Spam Analysis
Overview
This is a brief introduction to the Spam analysis page and the actions you can take there.
One way to detect Spam is to look for similar messages that are posted to multiple lists.
The analysis page shows the results of tallying emails by various header fields, including
Subject, From and ReturnPath.
For example, if a particular Subject is seen multiple times, this is quite likely to be
spam, similarly for the other header fields.
URL options
Various qualifiers can be added to the default URL
https://webmod.apache.org/spamalyse.html
- oldest=n
-
Show pending emails no older than n days. Can also specify hours, e.g. oldest=4h
Current default is 20 days
- minimum=n
- minimum count to show; current default 5 (20 for those with spamalyse karma)
- showRaw
-
Show the Raw columns (needed for Regex matching)
This only affects the tallies; the matching messages are always shown decoded.
- showSpam
-
Show pending requests already marked as spam by anyone; default is to ignore already marked entries.
Note that this only applies to the counts that are shown; when a value is selected, all pending mails are shown.
This helps confirm that the value really is associated with spam.
The setting is mainly intended to make it easier to mark obvious spam.
For example:
https://webmod.apache.org/spamalyse.html?minimum=5&showSpam
Possible actions
Clicking on an entry will show all the messages which match that header
(you might have to scroll down the page).
Clicking on a message will show an extract of the message.
You can also view the message text, source and html.
There are checkboxes on the left for selecting messages, and a button to flag all selected entries as spam.
Note: this skips messages which have already been marked by you, so reselecting them won't
slow down reporting.
Likewise, there is a button to cancel spam markers that you have applied.
Column details
Entries in the columns are sorted in descending order of occurrence, i.e. the most frequent are at the top.
Note that the entries in the columns are independent of each other.
An email which matches an entry in a particular column generally won't match the
entry in the corresponding row in other columns.
- FromHost
- The host(domain) part of the From address.
Hosts such as apache.org, gmail.com, hotmail.com etc are not tallied as they are known to contain both ham and spam.
The individual senders (FromRaw) are still tallied.
- FromRaw
- The full From address header value (intended for help in devising Regex filters)
- ReplyToHost
- The host(domain) part of the ReplyTo address.
As with FromHost, some hosts are not tallied.
- ReplyToRaw
- The full ReplyTo address header value (intended for help in devising Regex filters)
- ReturnPath
- The ReturnPath (enveloper sender). This is what is used by ezmlm to identify senders, not the From address.
- ReturnPathHost
- The host(domain) part of the ReturnPath.
The following columns only appear for users with spamalyse karma:
- SenderIP
- The IP address of the sender. This may be shared by multiple senders.
- SenderIP24
-
SenderIP, masked to 24 bits. This represents a block of 256 IP addresses, generally served by a single provider.
Some providers are not very diligent about preventing spam (or may indeed facilitate it).
But it is very easy for ham to get mixed in with the spam.
SenderIP24 is mainly intended for use by Infra in devising mail filters for persistent spammers.
Please take especial care when selecting messages by SenderIP24.
This includes a range of IP addresses, and it is easy for spam emails to swamp the genuine ones.
It is best to use one of the other selectors.