I recently added the conservative (mass-check testing hit ONLY spam) version
of all the SARE rules that had been updated in 2005. I figured that was as
good a place as any to start. So far so good. Thanks to the Ninjas.
Below are some related stats from my current maillog. I don't make any
claims to their validity or accuracy. Server config is spamd (SA 3.0.2)
being called as a content filter from Postfix. Postfix relays to a MS
Exchange server.
Anyone have observations or stats to compare?
Rhett Roy
top 10 individual SARE rule hits
1654 SARE_FROM_SPAM_WORD3
482 SARE_FROM_SPAM_WORD1
434 SARE_HEAD_SPAM
323 SARE_TOCC_COMBO1
302 SARE_URI_NO_THANKS
302 SARE_FROM_SPAM_WORD4
256 SARE_BOUNDARY_09
254 SARE_MSGID_IP
250 SARE_HEAD_XBEEN
204 SARE_REPLY_SPAMWORD1
total individual SARE rules that had one or more hits
277
total hits by SARE rule file
565 70_sare_header0.cf
200 70_sare_genlsubj0.cf
191 70_sare_specific.cf
130 70_sare_html0.cf
88 70_sare_evilnum0.cf
45 70_sare_uri0.cf
12 99_sare_fraud_post25x.cf
top 50 rule hits (SARE or other)
4898 RAZOR2_CF_RANGE_51_100
4814 RAZOR2_CHECK
3954 HTML_MESSAGE
3525 URIBL_SBL
3262 BAYES_99
3259 URIBL_OB_SURBL
2868 NO_RDNS
2815 DCC_CHECK
2541 URIBL_WS_SURBL
2499 DIGEST_MULTIPLE
1831 URIBL_SC_SURBL
1654 MIME_HTML_ONLY
1515 MSGID_FROM_MTA_ID
1227 URIBL_AB_SURBL
1147 BAYES_50
1012 HTML_90_100
994 HTML_80_90
950 HTML_IMAGE_RATIO_02
750 HTML_FONT_BIG
725 DRUGS_ERECTILE
682 MPART_ALT_DIFF
612 MIME_QP_LONG_LINE
612 DNS_FROM_AHBL_RHSBL
606 HTML_WEB_BUGS
603 HTML_TEXT_AFTER_BODY
597 DNS_FROM_RFC_POST
569 HTML_TEXT_AFTER_HTML
566 SARE_FROM_SPAM_WORD3
532 NO_RDNS2
515 MARKETING_PARTNERS
503 EXCUSE_1
500 RCVD_NUMERIC_HELO
473 EXCUSE_3
459 HTML_TAG_EXIST_TBODY
414 SARE_HEAD_SPAM
400 BAYES_00
398 RCVD_HELO_IP_MISMATCH
382 HTML_IMAGE_ONLY_08
382 EXCUSE_7
374 HTML_IMAGE_RATIO_04
373 PRIORITY_NO_NAME
354 HTML_40_50
318 BAYES_80
310 HTML_50_60
310 DRUGS_ERECTILE_OBFU
302 SARE_URI_NO_THANKS
299 HTML_NONELEMENT_00_10
298 REMOVE_PAGE
296 MIME_HTML_MOSTLY
-SPAM blocked by RBL today-
3436 - sbl-xbl.spamhaus.org
565 - dnsbl.sorbs.net
535 - dnsbl.njabl.org
Total SMTP Connections
6008
Total Rejected By RBL
4803
Total Flagged By SA
431
Total Delivered
774
Percentage Delivered
12
