Have any of you seen fewer spams? I don't see many these days.
About 15% of the spams I get are not in SURBL, but are by the time I try to add :)
I have not done any study of domains that continue to try to spam despite being in SURBL. Any numbers on these? Possibly the most/longest hit domain in SURBL lookups??
SHould we post the top 25 lookups to SURBL? This way people can look at maybe denying these by IP at firewall?
--Chris (I am an anal-retentive and highly-clueful well-motivated maniac.) ;)
on Thu, Nov 18, 2004 at 03:13:26PM -0500, Chris Santerre wrote:
Have any of you seen fewer spams? I don't see many these days.
Ove the past three weeks on one server, I've rejected this many spams:
4251 3730 3335 3580 3680 3120 3877 3614 3595 3403 4053 3637 3720 3623 3319 3705 3281 3625 3426 3396 3449 3875 4120 3830
So, um, no. A 2-day MA trendline shows a dip over the past week or so with a sharp uptrend in the past four or five days. The linear trendline is pretty much straight, though. Too bad - a few months ago I'd detected a downturn, but that may have been due to more aggressive network-level blocking (via ipchains/iptables).
On Thursday 18 November 2004 03:13 pm, Chris Santerre wrote:
Have any of you seen fewer spams? I don't see many these days.
Our graphs show the rates decreasing. http://user.pa.net/~lindsay/year_block.png
I'm not sure what other factors could be causing the graphs to tend downward but I do know the mail volume has increased and the code rbl/block code has not changed.
About 15% of the spams I get are not in SURBL, but are by the time I try to add :)
I have not done any study of domains that continue to try to spam despite being in SURBL. Any numbers on these? Possibly the most/longest hit domain in SURBL lookups??
I also haven't done a study recently but I could contribute data for analysis if we wanted to study any of it.
-Lindsay
Chris Santerre wrote:
Have any of you seen fewer spams? I don't see many these days.
About 15% of the spams I get are not in SURBL, but are by the time I try to add :)
Actually i've noticed an increase of spam. I usually get about 80 spam (i know it's not that much) during workhours, since i a few days back it's been about 110-120. Don't know why though :(
But SURBL still rocks! Can't live without it! :)
/ Martin
On Thursday, November 18, 2004, 12:13:26 PM, Chris Santerre wrote:
About 15% of the spams I get are not in SURBL, but are by the time I try to add :)
Ask Terry Sullivan sometime what the theoretical maximum detection rate of a collective spam classification system might be. He had some research showing it maxes out at around 85%. So we're probably already pretty close to the theoretical limits of this type of system.
I have not done any study of domains that continue to try to spam despite being in SURBL. Any numbers on these? Possibly the most/longest hit domain in SURBL lookups??
SHould we post the top 25 lookups to SURBL?
You mean like:
http://www.surbl.org/dns-queries.blocklist.counts.txt
This sample of blocklist hits of SURBL list DNS queries ranked by number of hits?
Or the overall DNS queries:
http://www.surbl.org/dns-queries.counts.txt
including blocklist, whitelist, and unmatched hits, etc.
http://www.surbl.org/links.html
This way people can look at maybe denying these by IP at firewall?
If you're talking about sender IPs, zombies would defeat that. Or do you mean having the firewall parse the email messages and do a name resolution on the URI domains?
Jeff C. -- "If it appears in hams, then don't list it."
On Friday, November 19, 2004, 2:38:20 AM, Jeff Chan wrote:
On Thursday, November 18, 2004, 12:13:26 PM, Chris Santerre wrote:
About 15% of the spams I get are not in SURBL, but are by the time I try to add :)
Ask Terry Sullivan sometime what the theoretical maximum detection rate of a collective spam classification system might be. He had some research showing it maxes out at around 85%.
(That should read "collaborative" for "collective". Pretty much the same meaning though: i.e. when multiple people decide what's spam.)
Jeff C. -- "If it appears in hams, then don't list it."
Hi!
Have any of you seen fewer spams? I don't see many these days.
You mean, spam that still passed the filters? I mean, volume didnt go down here, only the ones that passed the filter go down. Like 1% now gets in.
About 15% of the spams I get are not in SURBL, but are by the time I try to add :)
You are getting slow ;) haha. The JP filtering is doing pretty ok. We see around 150-300 new domains added daily, and the volume removal requests are also very very low the last three weeks. And that last one isnt only for JP, but the whole SURBL project in total. So i would like to thanks the people who took the time to walk over some older lists. It is really showing off!!
I have not done any study of domains that continue to try to spam despite being in SURBL. Any numbers on these? Possibly the most/longest hit domain in SURBL lookups??
Most spammers dont care ;) They never did ;)
Bye, Raymond.
-
Chris Santerre -
Jeff Chan -
Lindsay Snider -
Martin -
Raymond Dijkxhoorn -
Steven Champeon