[SURBL-Discuss] Re: New xs.surbl list
jeffc at surbl.org
Sat Apr 23 09:42:57 CEST 2005
On Friday, April 22, 2005, 11:47:25 AM, Patrik Nilsson wrote:
> At 01:38 2005-04-22 -0700, Jeff Chan wrote:
>>[forwarded with Paul's permission. Please comment.]
>> > I don't know the current method used to decide when to add domains
>> > to your new list, and I definitely see *much* smaller levels of spam than
>> > many others on the various mailing lists.
>>It's the top 97th percentile of hits, which only gets about a
>>hundred more new records (domains and IPs) than we already have
>>in SURBLs. We can crank that up later when we get the FP issues
>>nailed down better, though improved processing techniques.
>> > However, my own experience, so far,
>> > is that absolutely no "zero-hour" spams have been caught,
>>Yes, that's because the new URI hit counts must overcome the
>>mass of earlier reports. There may be smarter ways to organize
>>this, but simply lowering the threshold of inclusion (e.g., going
>>to the 98th percentile) would get more on the list sooner.
>> > but very many Spamcop
>> > reports (about 1/2 hour later) do trigger; So I have to agree with the
>> few who
>> > have suggested a much more aggressive decision about when to add.
>>Yes, I agree too. :-) When I announced the list for testing I
>>said we'd start conservative to get a feeling for the data.
> Could we maybe, just for testing, have two or more lists to test with
> different percentiles?
Probably we'll try XS at the 98th percentile next, take out the
SURBL hits, and try to list only domains that are less than a
How toes this sound to folks?
"If it appears in hams, then don't list it."
More information about the Discuss