RE: [Declude.JunkMail] Spam tests by months
WOW! I've send this message over 46 hours ago. It's only me to receive it on the list so late? Received: from declude.com [63.246.13.90] by mail.zcom.it with ESMTP (SMTPD32-8.13) id A0E9C6600B6; Fri, 11 Feb 2005 09:46:33 +0100Received: from mail.zcom.it [217.199.0.33] by mail.declude.com with ESMTP (SMTPD32-8.05) id ABE4656800A2; Wed, 09 Feb 2005 05:54:28 -0500Received: from NB [127.0.0.1] by mail.zcom.it with ESMTP (SMTPD32-8.13) id AC35211008C; Wed, 09 Feb 2005 11:55:49 +0100 I fear if this happens repeatedly an effective discussion is not more possible. Back to snail-mail? Markus From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Markus GuflerSent: Wednesday, February 09, 2005 11:56 AMTo: Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] Spam tests by months Hi Scott, great stat's ! A question about SNIFFER It seems you have a much longer list of different SNIFFER return codes then I Is there somewhere a complete list? Markus From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott FisherSent: Monday, February 07, 2005 10:14 PMTo: Declude.JunkMail@declude.comSubject: [Declude.JunkMail] Spam tests by months I've compiled my spam test results over the last year to look at test effectiveness trends. If anyone is interested I've posted them on my website. I've never really seen test effectiveness trended over a year period anywhere else. All tests spam vs. ham based on all emails. http://it.farmprogress.com/declude/Testsbymonth.html Spam tests based on all spam emails. http://it.farmprogress.com/declude/spamtestbymonth.html Ham tests based on all ham emails. http://it.farmprogress.com/declude/hamtestsbymonth.html Warning these are large HTML files. Someexamples: Spamcop triggered on 83% of my Feb 2004 spam emails and has downward trended to 57% of my January 2005 spam emails. Message Sniffer has stayed at 95-96% detection of all spam emails from June 2004 to Jan 2005.
RE: [Declude.JunkMail] Spam tests by months
I've send this message over 46 hours ago. It's only me to receive it on the list so late? I fear if this happens repeatedly an effective discussion is not more possible. Back to snail-mail? Our mailserver received millions of E-mails over the past few days. Once we detected the problem yesterday morning, we were able to block the E-mails and make sure that backed up E-mail got delivered. Just about all of the backed up E-mail has gone out. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spam tests by months
Although I dislike the term, ham to me is legit e-mail. - Original Message - From: Dan Geiser [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, February 07, 2005 5:13 PM Subject: Re: [Declude.JunkMail] Spam tests by months No, I mean what does Ham mean? Does Ham mean legit e-mail? Or is that like mail from BulkSenders which some people might consider Spam and some might consider legit? - Original Message - From: Scott Fisher [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, February 07, 2005 5:32 PM Subject: Re: [Declude.JunkMail] Spam tests by months My weighting system is this: 100 No action (27.7% of all mail in Jan 2005) 100 Subject tag (.5% of all mail) (1/3 of this weight range tend to be spam) 200 Hold (.5% of all mail) (I average 1 a month of Ham in hold) 300 Delete (71.3% of all mail) As I have to draw a line somewhere, I drew the line at 200. Everything held or deleted is considered spam. Everything under 200 is considered ham, I think this is fairly conservative. - Original Message - From: Dan Geiser [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, February 07, 2005 4:06 PM Subject: Re: [Declude.JunkMail] Spam tests by months Scott, How do you define Ham? Thanks, Dan - Original Message - From: Scott Fisher [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, February 07, 2005 4:14 PM Subject: [Declude.JunkMail] Spam tests by months I've compiled my spam test results over the last year to look at test effectiveness trends. If anyone is interested I've posted them on my website. I've never really seen test effectiveness trended over a year period anywhere else. All tests spam vs. ham based on all emails. http://it.farmprogress.com/declude/Testsbymonth.html Spam tests based on all spam emails. http://it.farmprogress.com/declude/spamtestbymonth.html Ham tests based on all ham emails. http://it.farmprogress.com/declude/hamtestsbymonth.html Warning these are large HTML files. Some examples: Spamcop triggered on 83% of my Feb 2004 spam emails and has downward trended to 57% of my January 2005 spam emails. Message Sniffer has stayed at 95-96% detection of all spam emails from June 2004 to Jan 2005. --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spam tests by months
Scott, How do you define Ham? Thanks, Dan - Original Message - From: Scott Fisher [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, February 07, 2005 4:14 PM Subject: [Declude.JunkMail] Spam tests by months I've compiled my spam test results over the last year to look at test effectiveness trends. If anyone is interested I've posted them on my website. I've never really seen test effectiveness trended over a year period anywhere else. All tests spam vs. ham based on all emails. http://it.farmprogress.com/declude/Testsbymonth.html Spam tests based on all spam emails. http://it.farmprogress.com/declude/spamtestbymonth.html Ham tests based on all ham emails. http://it.farmprogress.com/declude/hamtestsbymonth.html Warning these are large HTML files. Some examples: Spamcop triggered on 83% of my Feb 2004 spam emails and has downward trended to 57% of my January 2005 spam emails. Message Sniffer has stayed at 95-96% detection of all spam emails from June 2004 to Jan 2005. --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spam tests by months
My weighting system is this: 100 No action (27.7% of all mail in Jan 2005) 100 Subject tag (.5% of all mail) (1/3 of this weight range tend to be spam) 200 Hold (.5% of all mail) (I average 1 a month of Ham in hold) 300 Delete (71.3% of all mail) As I have to draw a line somewhere, I drew the line at 200. Everything held or deleted is considered spam. Everything under 200 is considered ham, I think this is fairly conservative. - Original Message - From: Dan Geiser [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, February 07, 2005 4:06 PM Subject: Re: [Declude.JunkMail] Spam tests by months Scott, How do you define Ham? Thanks, Dan - Original Message - From: Scott Fisher [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, February 07, 2005 4:14 PM Subject: [Declude.JunkMail] Spam tests by months I've compiled my spam test results over the last year to look at test effectiveness trends. If anyone is interested I've posted them on my website. I've never really seen test effectiveness trended over a year period anywhere else. All tests spam vs. ham based on all emails. http://it.farmprogress.com/declude/Testsbymonth.html Spam tests based on all spam emails. http://it.farmprogress.com/declude/spamtestbymonth.html Ham tests based on all ham emails. http://it.farmprogress.com/declude/hamtestsbymonth.html Warning these are large HTML files. Some examples: Spamcop triggered on 83% of my Feb 2004 spam emails and has downward trended to 57% of my January 2005 spam emails. Message Sniffer has stayed at 95-96% detection of all spam emails from June 2004 to Jan 2005. --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spam tests by months
No, I mean what does Ham mean? Does Ham mean legit e-mail? Or is that like mail from BulkSenders which some people might consider Spam and some might consider legit? - Original Message - From: Scott Fisher [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, February 07, 2005 5:32 PM Subject: Re: [Declude.JunkMail] Spam tests by months My weighting system is this: 100 No action (27.7% of all mail in Jan 2005) 100 Subject tag (.5% of all mail) (1/3 of this weight range tend to be spam) 200 Hold (.5% of all mail) (I average 1 a month of Ham in hold) 300 Delete (71.3% of all mail) As I have to draw a line somewhere, I drew the line at 200. Everything held or deleted is considered spam. Everything under 200 is considered ham, I think this is fairly conservative. - Original Message - From: Dan Geiser [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, February 07, 2005 4:06 PM Subject: Re: [Declude.JunkMail] Spam tests by months Scott, How do you define Ham? Thanks, Dan - Original Message - From: Scott Fisher [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Monday, February 07, 2005 4:14 PM Subject: [Declude.JunkMail] Spam tests by months I've compiled my spam test results over the last year to look at test effectiveness trends. If anyone is interested I've posted them on my website. I've never really seen test effectiveness trended over a year period anywhere else. All tests spam vs. ham based on all emails. http://it.farmprogress.com/declude/Testsbymonth.html Spam tests based on all spam emails. http://it.farmprogress.com/declude/spamtestbymonth.html Ham tests based on all ham emails. http://it.farmprogress.com/declude/hamtestsbymonth.html Warning these are large HTML files. Some examples: Spamcop triggered on 83% of my Feb 2004 spam emails and has downward trended to 57% of my January 2005 spam emails. Message Sniffer has stayed at 95-96% detection of all spam emails from June 2004 to Jan 2005. --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spam tests
Looks like SpamAssassin to me.. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott MacLean Sent: Wednesday, August 04, 2004 1:44 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Spam tests I received a forwarded email with these headers today. Don't know which spam filter product generated them, but they look like some neat tests: * 0.3 NO_REAL_NAME From: does not include a real name * 0.9 FROM_ENDS_IN_NUMS From: ends in numbers * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 0.0 CONGRATULATIONS BODY: Congratulations - you've been scammed? * 0.1 LINES_OF_YELLING_2 BODY: 2 WHOLE LINES OF YELLING DETECTED * 0.0 LINES_OF_YELLING BODY: A WHOLE LINE OF YELLING DETECTED * 0.6 SUBJ_ALL_CAPS Subject is all capitals * 2.2 FROM_HAS_ULINE_NUMS From: contains an underline and numbers/letters * 1.6 NIGERIAN_BODY1 Message body looks like a Nigerian spam message 1+ --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spam tests
Definitely SpamAssassin. If you want these tests and more, check out the signature at the bottom of one of Sanford Whiteman's recent posts. Andrew 8) -Original Message- From: Scott MacLean [mailto:[EMAIL PROTECTED] Sent: Wednesday, August 04, 2004 10:44 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] Spam tests I received a forwarded email with these headers today. Don't know which spam filter product generated them, but they look like some neat tests: * 0.3 NO_REAL_NAME From: does not include a real name * 0.9 FROM_ENDS_IN_NUMS From: ends in numbers * 0.6 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN) * 0.0 CONGRATULATIONS BODY: Congratulations - you've been scammed? * 0.1 LINES_OF_YELLING_2 BODY: 2 WHOLE LINES OF YELLING DETECTED * 0.0 LINES_OF_YELLING BODY: A WHOLE LINE OF YELLING DETECTED * 0.6 SUBJ_ALL_CAPS Subject is all capitals * 2.2 FROM_HAS_ULINE_NUMS From: contains an underline and numbers/letters * 1.6 NIGERIAN_BODY1 Message body looks like a Nigerian spam message 1+ snip --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
