Kaspersky Anti-Spam 3.0

List-based filtration. Sender IP addresses are checked against blacklists of spammers, which are maintained by Internet service providers and public organizations (DNS-based Blackhole Lists). System administrators can add addresses of trusted correspondents to a safe list, ensuring that their messages are always delivered without undergoing filtration.

SPF and SURBL technologies. The filtration process also involves verifying senders using the Sender Policy Framework. Detection of spammer IP addresses using DNSBL is supplemented by SURBL technology (Spam URI Real-time Block List), which can identify spam URLs in the message body.

Analysis of formal attributes. The program recognizes spam by such typical characteristics as distorted sender addresses or the absence of the sender’s IP address in DNS, an excessive number of intended recipients or hidden addresses. The size and format of messages are also taken into consideration.

Signature analysis. Lexical signature databases are updated around the clock. Using spam signatures, the program can even recognize modified versions of spam messages that have been altered to evade spam filters.

Linguistic heuristics. The program scans messages for words and phrases that are typical of spam messages. Both the content of the message itself and any attachments are analyzed.

Graphic spam. A database of signatures for graphic spam equips the program to block messages containing spam images, a type of spam that has become increasingly common in recent years.

Real-time UDS requests. The Urgent Detection System is updated with information on spam messages literally seconds after they first appear on the Internet. Messages that could not be assigned a definitive status (e.g., spam, no-spam) can be scanned using UDS.