Detection Layers

Brand Protection detects impersonation attacks that generic filters miss. Working from a brand list you curate, it covers the full range of impersonation tactics — from look-alike domains to display-name and subject-line spoofing — including CJK/Japanese native-script variants that Western-centric tools overlook.

The display-name and subject-line brand abuse that dominates real phishing gets caught. On live traffic, From-display-name spoofing alone out-volumes all domain-squatting techniques combined by ~40×.

Who's impersonating our brands? Are display-name attacks hitting us? What's the volume of CJK brand abuse?

Brand Protection answers these questions with a purpose-built detector that understands the tricks attackers use — and the language-specific variations that Western-centric tools miss.

Traditional brand protection watches domain registrars. Real phishing happens in the From display name and subject line — 'Support' as the display name with a random freemail domain, or 'Invoice: ACME Corp' in the subject with no brand reference in the sender.

These techniques out-volume domain squatting by 40×. Brand Protection catches them.

Rspamd's built-in neural classifier, upgraded into a production-grade detector. It reads each message in context — combining the message text with a rich set of structural and behavioural signals — to make far sharper spam/ham calls than a text-only model.

ROC AUC 0.998; false positives cut ~20× vs. Bayes and ~11× vs. the OSS text model at the same recall; ~4 ms/message; fully local; CPU-only; no data off-box. Trains online on the customer's own traffic. Multilingual (en/ru/CJK).

Those figures come from a held-out benchmark corpus. Your own numbers will differ: the Neural panel reports the live model's test AUC for the traffic it was actually trained on.

Can I do better than Bayes? What's the cost of this upgrade? Is it worth deploying?

The benchmark answers: at a fixed aggressive spam-catch rate, Premium neural lets through ~1 false positive for every 20 a Bayes-only setup would. For a busy system that's the difference between 'users trust the filter' and 'users check quarantine by hand.'

Generic ML classifiers see only message text. Premium neural reads the message in full context, combining content with a broad set of structural and behavioural signals. That added context is what separates good-enough accuracy from production-grade.

A dashboard over YARA rule scanning of message content and attachments, tiered by what a rule is looking for: malware, exploit, phishing, generically suspicious, and an allowlist tier that suppresses known-good matches.

Each tier reports hits and the percentage of those hits that ended in a reject, so you can see at a glance which tiers are earning their scan time.

A published YARA ruleset is mostly dead weight — a handful of rules do nearly all the work. The 'where it fires' table ranks rules on your live traffic by hits, rejects and reject rate, and names the source file each rule came from.

Every tier links through to Symbol Introspect, so a suspicious rule is one click away from its full operational profile.

An operator ruleset editor sits on the same page, appended to the rules shipped with the deployment. Unsupported YARA constructs are skipped rather than fatal, and an Audit pass tells you exactly which rules were skipped before you publish anything.

A test-scan panel compiles the shipped and draft rules together and scans a sample, so you can confirm a rule matches what you think it matches.

Operator-defined clustering rules group messages by shared characteristics: ASN, from-domain, header fingerprint, header order, or other lua_selectors. Clusters flag coordinated or botnet-like fanout with symbols CLUSTER_FANOUT, CLUSTER_REPUTATION, and CLUSTER_ANOMALY.

One-click actions let you block a cluster, capture it for analysis, or train fuzzy across all cluster members. Clusters drive Selector Grid rules — turn a cluster observation into a deployed scoring rule in one click.

Is this a coordinated attack? Which messages share this fingerprint? What's the scope of this campaign?

Clusters reveal patterns that span individual messages: a botnet sending from the same ASN across hundreds of domains, or a phishing kit with a distinctive header order.

The workflow flows from observation to action: Clusters detects a pattern, you verify it's abuse, click to build a Selector Grid rule from the cluster's selector, and ship it. Minutes from pattern detection to deployed rule.

Track reputation for senders and domains based on your traffic patterns. See which senders are problematic, which domains are legitimate, and identify emerging threats before they hit your filters.

The reputation panel shows a ranked list of senders and domains with key metrics: average score, spam/ham counts, spam percentage, and message volume. Sort by any column to find the worst offenders.

Every row carries Block and Allow buttons, split by target: on a domain row you can act on the URL domain or the envelope-from independently; IP rows block or allow the address. Each action appends one validated line to the matching operator map, idempotently — no duplicate entries, and the change is live on the next map poll.

The Bayes Classifier panel shows the health of your Bayes statistical classifiers: hit rates, score distribution, and training balance.

Monitor classifier drift, verify learning is working, and ensure your spam/ham training data stays balanced.

Is Bayes firing? What's the score distribution? Is our training balanced?

Bayes health checks ensure your statistical classifier is contributing to verdicts rather than sitting dormant.

A Bayes classifier that never fires or always scores zero isn't learning. The panel surfaces these issues so you can fix the underlying problem: missing learn tokens, imbalanced training, or misconfigured thresholds.

A dashboard per subscription — Spamhaus DQS, Abusix Mail Intelligence, SURBL and Fuzzy — each breaking the feed down by sub-service rather than reporting one hit count. See which parts of a feed you are paying for and which parts fire.

Fuzzy compares premium and bulk sources with an overlap view and a premium-accuracy card, so the question 'is the premium tier adding anything?' has an answer.

Which sub-services of this subscription actually contribute? Are two feeds telling us the same thing?

Pair these with Detection Impact: a feed with wide coverage but no decisive contribution is a renewal you can reconsider.

The URLs & Domains panel provides URL and domain analytics: most-seen domains, TLD distribution, and URL blocklist hit rates.

See which domains are appearing in your traffic, which TLDs are overrepresented in spam, and how your URL blocklists are performing.

Which domains appear most in our mail? What's the top TLD for spam? Are our URL blocklists firing?

URL and domain analytics help you identify abuse patterns and evaluate the effectiveness of your URL-based detection layers.

See hit rates for SURBL, Spamhaus DQS, and other URL blocklists. Identify which lists are contributing and which are redundant with your existing rules.

The Content & Attachments panel analyses MIME structure, content-type distribution, and attachment patterns across your traffic. See which file types are being sent, which content rules are firing, and how attachment patterns correlate with spam.

Track attachment volume by type, document format trends, and content-rule hit rates.

What attachment types are most common? Are PDFs correlated with spam? Which content rules are firing?

Content analytics help you understand the makeup of your email stream and tune content-based detection rules.

See which attachment types are overrepresented in spam: executables, archives, office documents with macros. Use this data to tune attachment-based scoring rules.