RE: [Declude.JunkMail] 10-fold increase in spam today
Can't see any significal increase. (see attached relative variation) Markus -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Thursday, November 18, 2004 11:07 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] 10-fold increase in spam today Looks like it settled down to only a 6x increase over 24 hours. Seems to be sustained, though...across all domains. Good thing is with some simple tweaks we're not seeing any more than normal slip through, so our catch rate looks to be 99.5% or betterand no more false positives than normal, so that % goes down correspondingly.to well under 0.5% of held or deleted potential spambut it's still a lot more to review manually...we'll probably quit that if it keeps up much longer. I see the spike never really materialized on your end. Anyone else see a spike in zombie spam? Darin. - Original Message - From: Pete McNeil [EMAIL PROTECTED] To: Darin Cox [EMAIL PROTECTED] Sent: Wednesday, November 17, 2004 4:27 PM Subject: Re: [Declude.JunkMail] 10-fold increase in spam today On Wednesday, November 17, 2004, 3:22:00 PM, Darin wrote: DC We're seeing a 10-fold increase in zombie spam today. DC DC ~90% of what slips through triggers either CMDSPACE or DC SNIFFER, so we've upped both of those to hold weights. DC DC Anyone else seeing this? We're seeing what could be a spike in the making. http://www.sortmonster.com/MessageSniffer/Performance/ChangeRates.jsp 0504 * Note done with today yet. 1729 * 2543 3532 4581 5467 _M --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. spam_variation.pdf Description: Adobe PDF document
Re: [Declude.JunkMail] 10-fold increase in spam today
Very telling graphic on the trends. What do you use to analyze your logs? We're probably small enough that our statistics are much less representative of the overall picture. It seems to be settling down a little bit. We're now only at about double the normal load. Darin. - Original Message - From: Markus Gufler [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, November 19, 2004 3:41 AM Subject: RE: [Declude.JunkMail] 10-fold increase in spam today Can't see any significal increase. (see attached relative variation) Markus -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Thursday, November 18, 2004 11:07 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] 10-fold increase in spam today Looks like it settled down to only a 6x increase over 24 hours. Seems to be sustained, though...across all domains. Good thing is with some simple tweaks we're not seeing any more than normal slip through, so our catch rate looks to be 99.5% or betterand no more false positives than normal, so that % goes down correspondingly.to well under 0.5% of held or deleted potential spambut it's still a lot more to review manually...we'll probably quit that if it keeps up much longer. I see the spike never really materialized on your end. Anyone else see a spike in zombie spam? Darin. - Original Message - From: Pete McNeil [EMAIL PROTECTED] To: Darin Cox [EMAIL PROTECTED] Sent: Wednesday, November 17, 2004 4:27 PM Subject: Re: [Declude.JunkMail] 10-fold increase in spam today On Wednesday, November 17, 2004, 3:22:00 PM, Darin wrote: DC We're seeing a 10-fold increase in zombie spam today. DC DC ~90% of what slips through triggers either CMDSPACE or DC SNIFFER, so we've upped both of those to hold weights. DC DC Anyone else seeing this? We're seeing what could be a spike in the making. http://www.sortmonster.com/MessageSniffer/Performance/ChangeRates.jsp 0504 * Note done with today yet. 1729 * 2543 3532 4581 5467 _M --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] 10-fold increase in spam today
A daily running vbscript parsing values from declude's delog.exe and counting files in the spam virus hold folder. The script stores the gathered values in a SQL-table. Then a MS Excel table connects trough an SQL query to the database and creates the diagram. Not very performant but it's doing his job. Pete McNeils MDLP it's doing part of this job in a similar way by processing decludes junkmail logfile. The resulting csv files can be imported also to a SQL-table and elaborated then in many different ways. Unfortunately there is no justdoit.exe for this. Maybe when God will give me some additional hors per day ;-) Markus -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Friday, November 19, 2004 3:15 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] 10-fold increase in spam today Very telling graphic on the trends. What do you use to analyze your logs? We're probably small enough that our statistics are much less representative of the overall picture. It seems to be settling down a little bit. We're now only at about double the normal load. Darin. - Original Message - From: Markus Gufler [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, November 19, 2004 3:41 AM Subject: RE: [Declude.JunkMail] 10-fold increase in spam today Can't see any significal increase. (see attached relative variation) Markus -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Thursday, November 18, 2004 11:07 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] 10-fold increase in spam today Looks like it settled down to only a 6x increase over 24 hours. Seems to be sustained, though...across all domains. Good thing is with some simple tweaks we're not seeing any more than normal slip through, so our catch rate looks to be 99.5% or betterand no more false positives than normal, so that % goes down correspondingly.to well under 0.5% of held or deleted potential spambut it's still a lot more to review manually...we'll probably quit that if it keeps up much longer. I see the spike never really materialized on your end. Anyone else see a spike in zombie spam? Darin. - Original Message - From: Pete McNeil [EMAIL PROTECTED] To: Darin Cox [EMAIL PROTECTED] Sent: Wednesday, November 17, 2004 4:27 PM Subject: Re: [Declude.JunkMail] 10-fold increase in spam today On Wednesday, November 17, 2004, 3:22:00 PM, Darin wrote: DC We're seeing a 10-fold increase in zombie spam today. DC DC ~90% of what slips through triggers either CMDSPACE or DC SNIFFER, so we've upped both of those to hold weights. DC DC Anyone else seeing this? We're seeing what could be a spike in the making. http://www.sortmonster.com/MessageSniffer/Performance/ChangeRates.jsp 0504 * Note done with today yet. 1729 * 2543 3532 4581 5467 _M --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] 10-fold increase in spam today
It certainly does the job. I started a parser to grab all of the info months ago on tests failed, whitelisting, and spam/virus counts, but just haven't had time to get back to it yet to finish. Maybe if we all pray for days to be extended to 28-30 hours we'll get an answer grin. Take 2 hours out of that for a little sleep and we still have an extra 2-4 hours/day... Darin. - Original Message - From: Markus Gufler [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, November 19, 2004 9:28 AM Subject: RE: [Declude.JunkMail] 10-fold increase in spam today A daily running vbscript parsing values from declude's delog.exe and counting files in the spam virus hold folder. The script stores the gathered values in a SQL-table. Then a MS Excel table connects trough an SQL query to the database and creates the diagram. Not very performant but it's doing his job. Pete McNeils MDLP it's doing part of this job in a similar way by processing decludes junkmail logfile. The resulting csv files can be imported also to a SQL-table and elaborated then in many different ways. Unfortunately there is no justdoit.exe for this. Maybe when God will give me some additional hors per day ;-) Markus -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Friday, November 19, 2004 3:15 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] 10-fold increase in spam today Very telling graphic on the trends. What do you use to analyze your logs? We're probably small enough that our statistics are much less representative of the overall picture. It seems to be settling down a little bit. We're now only at about double the normal load. Darin. - Original Message - From: Markus Gufler [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, November 19, 2004 3:41 AM Subject: RE: [Declude.JunkMail] 10-fold increase in spam today Can't see any significal increase. (see attached relative variation) Markus -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Thursday, November 18, 2004 11:07 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] 10-fold increase in spam today Looks like it settled down to only a 6x increase over 24 hours. Seems to be sustained, though...across all domains. Good thing is with some simple tweaks we're not seeing any more than normal slip through, so our catch rate looks to be 99.5% or betterand no more false positives than normal, so that % goes down correspondingly.to well under 0.5% of held or deleted potential spambut it's still a lot more to review manually...we'll probably quit that if it keeps up much longer. I see the spike never really materialized on your end. Anyone else see a spike in zombie spam? Darin. - Original Message - From: Pete McNeil [EMAIL PROTECTED] To: Darin Cox [EMAIL PROTECTED] Sent: Wednesday, November 17, 2004 4:27 PM Subject: Re: [Declude.JunkMail] 10-fold increase in spam today On Wednesday, November 17, 2004, 3:22:00 PM, Darin wrote: DC We're seeing a 10-fold increase in zombie spam today. DC DC ~90% of what slips through triggers either CMDSPACE or DC SNIFFER, so we've upped both of those to hold weights. DC DC Anyone else seeing this? We're seeing what could be a spike in the making. http://www.sortmonster.com/MessageSniffer/Performance/ChangeRates.jsp 0504 * Note done with today yet. 1729 * 2543 3532 4581 5467 _M --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http
Re: [Declude.JunkMail] 10-fold increase in spam today
Looks like it settled down to only a 6x increase over 24 hours. Seems to be sustained, though...across all domains. Good thing is with some simple tweaks we're not seeing any more than normal slip through, so our catch rate looks to be 99.5% or betterand no more false positives than normal, so that % goes down correspondingly.to well under 0.5% of held or deleted potential spambut it's still a lot more to review manually...we'll probably quit that if it keeps up much longer. I see the spike never really materialized on your end. Anyone else see a spike in zombie spam? Darin. - Original Message - From: Pete McNeil [EMAIL PROTECTED] To: Darin Cox [EMAIL PROTECTED] Sent: Wednesday, November 17, 2004 4:27 PM Subject: Re: [Declude.JunkMail] 10-fold increase in spam today On Wednesday, November 17, 2004, 3:22:00 PM, Darin wrote: DC We're seeing a 10-fold increase in zombie spam today. DC DC ~90% of what slips through triggers either CMDSPACE or DC SNIFFER, so we've upped both of those to hold weights. DC DC Anyone else seeing this? We're seeing what could be a spike in the making. http://www.sortmonster.com/MessageSniffer/Performance/ChangeRates.jsp 0504 * Note done with today yet. 1729 * 2543 3532 4581 5467 _M --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] 10-fold increase in spam today
On Wednesday, November 17, 2004, 3:22:00 PM, Darin wrote: DC We're seeing a 10-fold increase in zombie spam today. DC DC ~90% of what slips through triggers either CMDSPACE or DC SNIFFER, so we've upped both of those to hold weights. DC DC Anyone else seeing this? We're seeing what could be a spike in the making. http://www.sortmonster.com/MessageSniffer/Performance/ChangeRates.jsp 0504 * Note done with today yet. 1729 * 2543 3532 4581 5467 _M --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
