User guide

Using VStream Antispam
528 Check Point Safe@Office User Guide
How VStream Antispam Works
VStream Antispam works as follows:
1. A TCP connection arrives at the SMTP port (TCP 25) or the POP3 port (TCP
110).
2. The connection is checked against the VStream Antispam policy, to determine
whether it should be scanned.
3. If the IP Reputation engine is enabled, and the connection is an SMTP
connection:
a. VStream Antispam sends the connection's source IP address to a VStream
Antispam data center.
b. The VStream Antispam data center checks the reputation of this IP
address against a list of known spam sender IP addresses, and then
returns a spam score.
c. One of the following things happens:
 If the spam score does not exceed the configured confidence level, the
email passes to the next enabled VStream Antispam engine for
processing.
Figure 36:
VStream Antispam Flow