Scott, will CYBERsitter be in the December stats? I know we came in late in the month for November.
Thanks Brian On 12/02/02 1:51pm you wrote... >In April, we started to go through our spamtraps (E-mail addresses designed >to collect spam), to find out which spam tests were most effective at >catching spam. The results this month are based on over 14,000 spams that >were received, all in November, 2002. In November, our spamtraps received >about 10% more spam than in October. In November, we received over 3.5x >the amount of spam that we received in January. > >The following is a list of tests that we run against the E-mails arriving >at the spamtrap, and what percentage of the spam they caught (it will be >easier to read if you use a fixed-width font): > > >WEIGHT10 99.48% >WEIGHT20 96.66% >SNIFFER 86.61% >IPNOTINMX 80.28% >SPAMCOP 79.68% >XBL 70.97% >WIREHUB-DNSBL 64.69% >MAILDEFLECTOR 50.38% >POSTFIXGATE 42.83% >SPAMHEADERS 39.49% >REVDNS 34.52% >OSSRC 31.82% >HELO 29.99% >INTERSIL 29.12% >NOPOSTMASTER 28.03% >BADHEADERS 26.63% >SPAMHAUS 24.48% >DSBLALL 23.84% >DORKZTL 23.75% >NOABUSE 22.75% >HEUR10 21.85% >DSBL 21.68% >OSSOFT 20.97% >BLARSBL 17.11% >OSPROXY 16.12% >FIVETENDUL 15.48% >HEUR9 14.20% >VOX 13.90% >FIVETENSRC 13.31% >BLITZEDALL 12.63% >MONKEYPROXIES 12.44% >IPWHOIS 12.17% >ROUTING 11.90% >NJABL 11.18% >BASE64 10.24% >BLITZEDHTTP 9.51% >HEUR8 9.01% >DNSRBL-SPAM 8.97% >OSRELAY 8.40% >FIVETENIGNORE 8.11% >KUNDENSERVER 7.68% >ORDB 7.24% >RSL 6.31% >DELINK 5.62% >DORKS 5.55% >FIVETENOPTIN 4.96% >BADWHOIS 4.94% >SPAMBAG 4.00% >BLITZEDSOCKS 3.48% >DSN 3.38% >KITHRUP 3.34% >FABELSOURCES 3.15% >COMPU 2.96% >DNSRBL-DUN 2.81% >DEVNULL 2.35% >DSBLMULTI 2.11% >MAILFROM 2.06% >NJABLDUL 2.02% >WIREHUB-DYNA 1.94% >LNGSDUL 1.61% >PIGS 0.88% >OSDUL 0.70% >MONKEYFORMMAIL 0.62% >ABL 0.50% >DORKRELAYS 0.42% >FIVETENOTHER 0.40% >FIVETENMULTI 0.38% >LNGSBLOCK 0.32% >FLOWGO 0.23% >FIVETENWEBFORM 0.20% >BLITZEDWINGATE 0.16% >LNGSSRC 0.04% >JIPPG-DUL 0.03% >JIPPG-DULJP 0.01% > > >The WEIGHT10 and WEIGHT20 tests are just a weighting system that assigns a >weight to each E-mail, based on the spam tests that fail, so they don't >really count as spam tests by themselves (although they do catch the most >spam). It's also important to note that different tests are more likely to >produce false positives (such as the XBL, REVDNS, and SPAMHEADERS tests, >that all catch a lot of spam); those tests are best used in a weighting >system, so E-mail will only be marked as spam if it fails a combination of >tests. > >The two best tests by far are SNIFFER ( http://www.sortmonster.com ) at >86.61% and SPAMCOP ( http://www.spamcop.net ) at 79.68%. However, there >are more and more reports of SPAMCOP reporting false positives (which they >will hopefully fix by adding the 'spam to legitimate mail ratio' to their >TXT record). > >An interesting detail from this list is that over 10% of spam fails the >BASE64 test (compared to 7% last month), which detects text or HTML that is >specially encoded just so that it can bypass filters. > >More information on most of the various spam tests shown above can be found >at http://www.declude.com/junkmail/support/ip4r.htm . You can look up an >IP address using the Spam Database Lookup tool at http://www.DNSstuff.com >.. The most recent 20 spams in our spamtraps, and the tests they failed, >can be found at http://www.declude.com/spamtrap.htm . > > -Scott >--- >Declude: Anti-virus, Anti-spam and Anti-hijacking solutions for >IMail. http://www.declude.com > >--- >[This E-mail was scanned for viruses by Declude Virus >(http://www.declude.com)] > > >To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html >List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ >Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
