Where do we find the exact syntax for the tests you are using. I don't see all of them in the Declude manual.
Thanks. Fred ----- Original Message ----- From: "Markus Gufler" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, June 11, 2003 10:01 AM Subject: RE: [Declude.JunkMail] DSBL Tests - results > > > > Markus, I think that the CPU usage difference between using > > one IP/Domain test versus using 100 would be very minimal... > > Maybe you're right. I will try out to add more ip4r-tests. Can you post > me (off list) the ip4r-part of your config file so that I can simply > copy it instead of creating any line from decludes DNS-test-page? > > My doubt is that if we use the result of too much spam-db's we have to > wait until enough of them have added a new spaming IP to reach the hold > value. If we use to few spam-db's this can result in FP's. So I think > the best compromise is to use between 5 and 15 of the actualy best > working spam-db's. > > Here are the results of the last 15 hours on our server: > > 429 NOMOREFUNN > > Looks good, but checking manualy the log-files I've counted over 65% of > FP's > Bad test! > > > 302 EASYNET-DNSBL > > Haven't found any FP in the logs. But from 50 messages failing this test > 47 has failed also at least 3 other ip4r-tests. (MonkeyforProxies, > SpamCop, OSProxy, OSSoft, SBL, DSBL...) > > > 186 DSBL > 141 SPAMCOP > 124 MONKEYPROXIES > 113 SBL > 112 OSPROXY > 94 OSSOFT > 87 OSSRC > > The same thing for all this tests. Looks like a combination of all this > tests (where each one has as weight of 25% of the hold value) is a very > solid indicator for spam. > > Remains the ip4r-test from place 10 to 20: > I've noted that specialy the BHOLE-tests catch spam messages that are > not covered by the other ip4r-tests. I haven't found any FP vote from a > BHOLE test, but on our server we have practicaly no traffic from this > countries. So I'm not sure how good the BHOLE-tests are working. > > 47 BHOLE-CHINA > 47 BHOLE-CN-KR > 41 VOX > 30 OSRELAY > 26 OSDIPS > 25 INTERSIL > 24 BHOLE-KOREA > 20 BHOLE-BRAZIL > 17 NJABL > 16 ORDB > 11 OSDUL > > > BTW: > in the same time (15 hours) our SpamChk has given 2120 votes. > 940 of them has had a positive result. > The other 1180 votes was negative. (indicating legit content) > > >From the 1180 messages with a negative spamchk-vote: > > * 472 has also failed declude's NOLEGITCONTENT test. > * only 5 has failed any of the above ip4r-tests, > except for NOMOREFUNN > > > Markus > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
