Ironport SPAM

[ccg-security]

HI Cisco Support,

Based on our message tacking, some of our incoming messages are tagged as spam and we want to know why is it tagged as spam. What are the criteria or scanning procedure to tagged as SPAM?

Thank you and Best Regards!

[Libin Varghese · Accepted solution]

Hi,

To identify these threats, IronPort Anti-Spam examines the full context of a message-its content, methods of message construction, the reputation of the sender, the reputation of web sites advertised in the message, and more. IronPort Anti-Spam combines the power of email and web reputation data, leveraging the full power of the world's largest email and web traffic monitoring network — SenderBase — to detect new attacks as soon as they begin.

IronPort Anti-Spam analyzes over 100,000 message attributes across the following dimensions:

• Email reputation — who is sending you this message?
• Message content — what content is included in this message?
• Message structure — how was this message constructed?
• Web reputation — where does the call to action take you?

Analyzing multi-dimensional relationships allows the system to catch a broad range of threats while maintaining accuracy. For example, a message that has content claiming to be from a legitimate financial institution but that is sent from an IP address on a consumer broadband network or that contains a URL hosted on a “zombie” PC will be viewed as suspicious. In contrast, a message coming from a pharmaceutical company with a positive reputation will not be tagged as spam even if the message contains words closely correlated with spam.

Keeping the above in mind the rules triggered would vary from email to email.

Thanks,
Libin Varghese

[ccg-security]

Hi Libin,

Thank you very much for the information. We saw the message header that the message is positive on Spam. how can we decrypt the X-Ironport Spam header to determine what's the cause of that email that marked as spam? Is there any way to determine based on message header what's the cause of SPAM issue on a specific email?

Our customer want's to know why the specific message marked as spam? We understand that it's based on senderbase or any database but what is the main reason that marked as spam?

Thank you and Best Regards!

[Libin Varghese · Accepted solution]

Hi,

The Spam verdict header can only be analyzed by the internal team at Cisco. If you require information regarding a specific email you would need to open a TAC case to get that reviewed.

- Libin V

[Ravi Singh]

Please see the below link

How do I decode the X-IronPort-AV header on the ESA?

Our customer want's to know why the specific message marked as spam?

You can put this email sender in a white list, then it will be not be checked by ESA. Moreover you can also report to cisco about the same.

[abdelhamid_mahmoud]

Hi libin,

kindly, what is your mean about  "the reputation of the sender"? domain (IP address of the domian) or sender account name as libin@cisco.com?

Thanks