We’ve added a new layer to our email filtering engine, Avalanche, that targets the rising threat of Snowshoe Spam.
Like a snowshoe spreads the load of a traveller across a wide area of snow, snowshoe spamming is a technique used by spammers to spread junk and malicious email output across many IP addresses and domains in order to dilute reputation metrics and evade filters.
Traditional anti-spam databases pick up bad IP addresses and bad domains pretty quickly after a spam attack starts, normally within an hour. Snowshoe spammers are clever and have access to millions of zombie computers around the world, plus access to the same databases and message content spamming rules that the email service providers use. They’re able to stay one step ahead of the databases and craft their emails such that they aren’t recognised as spam due to their content. They also register hundreds of domain names every day and rapidly send out a short burst of malicious emails and then never use them again. By the time the databases have picked up on it, they’ve already moved on to another range of IP addresses and domain names. Our Avalanche platform spots a new attack within seconds, putting the spam where it belongs – buried deep inside the user’s spam folder.
In a sample of one million emails accepted by our email platform on Friday 3rd October, we identified approximately 151,912 emails as spam using existing methods: with Avalanche enabled they picked up an additional 57,824 emails – an increase in effectiveness of around 38%. As the platform continues to ‘learn’ the effectiveness will continue to improve. There is, of course, a small risk of false positives which will diminish over time and any domain that does get identified as spam by the Avalanche system will only be tagged as such for a period of 24 hours, and then never again.
It’s virtually impossible to remove all spam and malicious email – but we’re confident that our newly enhanced, multi-layered, approach to spam filtering will provide one of the cleanest email platforms available – for our direct customers as well as those of our Channel Partners.