IceWarp Antispam LIVE

Figure. Antispam Live Main view.

IceWarp Server can use IceWarp Antispam LIVE, an example of RPD (Recurring Pattern Detection) technology, as part of its fight against spam.

A Real-Time Detection Center analyzes large volumes of Internet traffic in real time, identifying new spam, virus and phishing outbreaks based on characteristic mass distribution patterns. Emerging outbreaks are usually identified moments after they are introduced onto the Internet.

This can significantly help in protecting your users from bulk and spam emails.

As with other IceWarp Antispam technologies, IceWarp Antispam LIVE is used to adjust the spam score of a message rather than to give a final judgment on the message:

Figure. General section.

Field

Description

Active

Enables Antispam LIVE based on RPD (Recurrent Pattern Detection) technology.

(This technology automatically analyzes billions of Internet transactions in real-time in its global data centers to identify new threats as they are initiated, protecting email infrastructures.)

Score bulk and suspected virus messages

Set the slider to an amount that will be added to the spam score if IceWarp Antispam LIVE reports the message as bulk.

Score confirmed spam messages

Set the slider to an amount that will be added to the spam score if IceWarp Antispam LIVE reports the message is a spam.

Given the proven reliability of IceWarp Antispam LIVE it is recommended that this be set at 9 or more.

Score non-spam messages

Set the slider to an amount that the spam score will be reduced by if IceWarp Antispam LIVE reports the message as not a spam.

The default value is 0 because reducing the score too much can result in False Positives member that LIVE is one of several technologies adding up to the overall score.

Figure. Zero-Hour Antivirus section.

Field

Description

Suspected virus message action:

Select an action for messages that are suspected.

  • Add spam score: choosing this option causes IceWarp Server adds spam score to the message.

  • Delete: choosing this option causes IceWarp Server deletes the message suspected as a virus..

  • Reject: choosing this option causes IceWarp Server rejects the message suspected as a virus.

Confirmed virus message action:

Select an action for messages that are suspected.

  • Add spam score: choosing this option causes IceWarp Server adds spam score to the message.

  • Delete: choosing this option causes IceWarp Server deletes the message confirmed as a virus..

  • Reject: choosing this option causes IceWarp Server rejects the message confirmed as a virus.

Figure. Outgoing Antispam section.

Field

Description

Outgoing bulk and suspicious spam message action:

Select an action for messages that are suspected.

  • Add spam score: choosing this option causes IceWarp Server adds spam score to the message.

  • Delete: choosing this option causes IceWarp Server deletes the message suspected as a virus..

  • Reject: choosing this option causes IceWarp Server rejects the message suspected as a virus.

  • Reject and disable sender: choosing this option causes IceWarp Server rejects the message and disable bulk and suspicious spam message sender.

Outgoing confirmed spam message action

Select an action for messages that are suspected.

  • Add spam score: choosing this option causes IceWarp Server adds spam score to the message.

  • Delete: choosing this option causes IceWarp Server deletes the message suspected as a virus..

  • Reject: choosing this option causes IceWarp Server rejects the message suspected as a virus.

  • Reject and disable sender: choosing this option causes IceWarp Server rejects the message and disable bulk and suspicious spam message sender.

Block Sender of outgoing virus message:

Select an action for messages that are suspected.

  • Never: choosing this option causes IceWarp Server never block sender of outgoing virus message.

  • Suspected and confirmed virus: choosing this option causes IceWarp Server blocks sender if the message is classified as suspected and confirmed virus.

  • Confirmed virus: choosing this option causes IceWarp Serverblocks sender if the message is classified as confirmed virus.

Notify administrator when account is blocked

Check this box if you want to notify administrator when account is blocked.

Note: The IceWarp Antispam LIVE engine is only called for messages which are not classified as a spam by IceWarp Server's other Antispam engines, according to the Score required to classify a message as spam setting in Antispam - Action - General.

IceWarp Antispam LIVE Reasons - identified as LIVE:

Code issued Reason

Y

This message is flagged as highly likely spam by the IceWarp Antispam LIVE servers.

H

This message is flagged as highly likely to be a bulk mail.

N

This message is considered genuine.

Note: Some servers block external access to port 80, thus they need to know what address is for IceWarp Antispam LIVEto free it up in their firewalls.
This information is in the ctasd.conf file (<InstallDirectory>/spam/commtouch):

Server_address = Resolver%d.icew.ctmail.com

Where %d is some dynamic number.