The following is a list of tests that we run against the E-mails arriving at the spamtraps, and what percentage of the spam they caught (it may be easier to read if you use a fixed-width font):
WEIGHT10 99.48% WEIGHT20 95.45% NOLEGITCONTENT 95.43% SNIFFER 94.06% SPAMCHK 93.20% IPNOTINMX 90.76% SPAMCOP 79.83% CMDSPACE 77.37% MAILDEFLECTOR 66.95% CBL 58.72% BLARSBL 58.45% DSBLALL 56.30% FIVETENSRC 56.28% DSBL 56.23% SORBS-DUHL 41.49% NOPOSTMASTER 32.95% NOABUSE 31.42% AHBL 28.59% REVDNS 22.41% BADHEADERS 22.28% HELO 21.26% SPAMHAUS 20.27% NJABLPROXIES 20.04% ROUTING 17.24% SORBS-SPAM 14.13% IPWHOIS 13.05% SORBS-HTTP 11.63% SORBS-SOCKS 11.33% NJABLSOURCES 10.66% DSN 9.25% SPAMHEADERS 8.68% RSL 8.61% NJABLDUL 6.47% BLITZEDALL 6.17% LNGSBLOCK 4.71% FIVETENIGNORE 4.50% BASE64 3.98% SPAMBAG 3.81% LNGSDUL 3.74% COMMENTS 3.70% FABELSOURCES 3.50% MAILFROM 1.91% BADWHOIS 1.90% SORBS-MISC 1.30% SPFFAIL 0.71% SORBS-SMTP 0.70% NJABL 0.66% INTERSIL 0.57% NONENGLISH 0.57% SORBS-WEB 0.54% ORDB 0.51% DNSRBL-DUN 0.28% FIVETENOPTIN 0.24% SORBS-ZOMBIE 0.20% KITHRUP 0.16% DNSMAILLIST 0.13% DSBLMULTI 0.12% FIVETENOTHER 0.11% JIPPG-DUL 0.09% DNSRBL-SPAM 0.09% FIVETENMULTI 0.03% KUNDENSERVER 0.02% FIVETENWEBFORM 0.01% DNSUCE 0.00% NJABLFORMMAIL 0.00% DEVNULL 0.00% JIPPG-DULJP 0.00% LNGSSRC 0.00% FLOWGO 0.00%
The WEIGHT10 and WEIGHT20 tests are part of a weighting system that assigns a weight to each E-mail, based on the spam tests that fail, so they don't really count as spam tests by themselves (but, they show that you can catch well over 95% of spam with extremely few false positives, and without relying on a single spam test). It is also important to note that different tests are more likely to produce false positives, which is what makes the weighting system so useful (E-mail will only be marked as spam if it fails a combination of tests). The NOLEGITCONTENT and IPNOTINMX tests were designed to help identify legitimate E-mail (rather than spam), which accounts for their high percentages.
What has proven to be very interesting over the past few months is the new CMDSPACE test, which is designed to detect spamware that doesn't follow the RFCs exactly. Over 75% of all spam can be caught with this one test (with a real false positive ratio of 0.00049 in our testing). Also, over 20% of the spam this month could safely be caught by the BADHEADERS test (since no RFC-compliant mail client will send out E-mail that fails the BADHEADERS test). That's a lot of spam that can be caught safely.
More information on most of the spam tests shown above can be found at http://www.declude.com/junkmail/support/ip4r.htm . You can look up an IP address using the Spam Database Lookup tool at http://www.DNSstuff.com to see what spam databases it is listed in. The most recent 20 spams in our spamtraps, and the tests they failed, can be found at http://www.declude.com/spamtrap.htm .
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection.
Find out what you have been missing: Ask for a free 30-day evaluation.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
