Email Threats

Spam Messages Blocked

Telemetry data in this section was provided by Microsoft Forefront Online Protection for Exchange (FOPE), which provides spam, phishing, and malware filtering services for thousands of enterprise customers and tens of billions of messages per month.

Messages blocked by FOPE each month from July 2010 to June 2011

Messages blocked by FOPE each month from July 2010 to June 2011

Click on the Image to Enlarge

  • The volume of spam blocked by FOPE decreased dramatically over the past 12 months, from a high of 89.2 billion messages in July 2010 to a low of 21.9 billion in May 2011, due in large measure to takedowns of two major botnets: Cutwail, which was shut down in August 2010 , and Rustock, which was shut down in March 2011 following a period of dormancy that began in January
  • The magnitude of this decrease suggests that coordinated takedown efforts such as the ones directed at Cutwail and Rustock can have a positive effect on improving the health of the email ecosystem.

FOPE performs spam filtering in two stages. Most spam is blocked by servers at the network edge, which use reputation filtering and other non-content-based rules to block spam or other unwanted messages. Messages that are not blocked at the first stage are scanned using content-based rules, which detect and filter many additional email threats, including attachments that contain malware.

Percentage of incoming messages blocked by FOPE using edge-blocking and content filtering from July 2010 to June 2011

Percentage of incoming messages blocked by FOPE using edge-blocking and content filtering from July 2010 to June 2011

Click on the Image to Enlarge

  • Between 85 and 95 percent of incoming messages were blocked at the network edge each month, which means that only 5 to 15 percent of incoming messages had to be subjected to the more resource-intensive content filtering process.
  • The decline in the percentage of messages blocked at the network edge beginning in January is due to the overall decline in the volume of spam that occurred following the inactivation of the Rustock botnet.

Top of page Top of Page

SIR

Locations

United States Change All Microsoft Sites

Search

Feedback:

Was the information in this article helpful?