Natural-Born Spam Killers

How It Works: Spam-Filtering Software

As spammers get trickier, so does the software designed to thwart them. Some utilities rely entirely on filters--rules that scan a message's header, subject, and body text for telltale signs of spam. Others rely on external "blackhole lists" (sometimes called blocklists or blacklists in spam filtering software) to keep out any mail coming from IP addresses used by spammers. Still other utilities compare parts of a message to a massive database of spam, looking for similarities. Most use a combination of tactics, along with sophisticated algorithms that assign a spam-probability score to each message. Here's how a few of the more common techniques work.

1. Spam filters look hard at the return address, which is often fake. In this case, the address consists almost entirely of numbers, a common component of machine-generated spam.
   
   
2. A filter may examine the IP address where the e-mail originated and compare it against lists of addresses known to be sources of spam. If it finds a match, that e-mail is usually blocked.
   
   
3. Some antispam software compares the date on the message against the time it's actually received; spammers will either delete the date or assign one in the future so that the e-mail lands at the top of its victims' mailboxes.
   
   
4. Common catchphrases in the subject line (like as seen on TV and free gifts) are another giveaway; many spammers also insert garbage characters, misspellings, or odd letter spacing in an attempt to fool simple text filters.
   
   
5. Lines entirely in capital letters--or oversize fonts in HTML mail--are a common spam tactic, so some filters flag messages that contain them.