Yet Another Ninja wrote: > there are no users - its trap domains which have never had any real > users - ever. > .... > no prefiltering except rejecting potential bounces and stuff leaking > from whatever may be on DNSWL and a coupleof other WLs.
Alex, Your stats are certainly valuable and illustrative... but not reflective of the stats one would see in a MOST "real world" mail streams where: (A) the spams were sent to actual users (which would be a distinctively different mix of spams compared to a pure honeypot stream of spams--for example, there'd be more "can-spam spam"/snowshoe spam in the real user mix, as well as less spam easily block by other techniques) --AND-- (B) where most of the messages have been prefiltered by FP-safe sender IP blacklists like Zen (which would then also alter the makeup of the spam stream--this would cause a lowered percentage of the "easy" stuff left over for the URI lists to process... and a higher percentage of the "hard" stuff left for the URI lists to process). Those two things would alter those stats dramatically and would paint a very different picture for some of those uri blacklists you compared. BTW - don't get me wrong... URIBL would still fare VERY well either way--so don't think I'm saying or implying ANYTHING bad about URIBL! (or anything bad about ANY other list) (fwiw) -- Rob McEwen http://dnsbl.invaluement.com/ [email protected] +1 (478) 475-9032
